soltanali0/cve-2025-1094-exploitWebSocket and SQL Injection Exploit Script
This repository contains a proof of concept (PoC) exploit for CVE-2025-1094, a vulnerability in PostgreSQL that allows an SQL Injection (SQLi) attack to escalate to Remote Code Execution (RCE) through WebSocket hijacking.
This exploit leverages an SQL Injection vulnerability in PostgreSQL to inject malicious code that reads sensitive files, such as /etc/passwd, and stores them on the vulnerable server. The exploit then hijacks an active WebSocket connection to execute arbitrary commands, ultimately achieving a remote shell on the compromised server.
SQL Injection (SQLi): The attack begins with injecting malicious SQL commands into a vulnerable PostgreSQL endpoint. The payload uses lo_export to read sensitive files from the server.
WebSocket Hijacking: The attacker hijacks an open WebSocket connection and sends a payload to execute the RCE. This triggers a reverse shell connection back to the attacker’s system.
Remote Code Execution (RCE): The reverse shell provides the attacker full control over the server, allowing further exploitation.
SELECT lo_export( (SELECT convert_from(pg_read_file('/etc/passwd'), 'UTF8')), '/tmp/payload');
The above SQL payload reads the /etc/passwd file and saves it as /tmp/payload. Once the file is retrieved, the exploit uses WebSocket hijacking to establish a reverse shell.
Clone the repository:
git clone https://github.com/soltanali0/CVE-2025-1094.git
cd CVE-2025-1094
Modify the following variables in the script:
REVERSE_IP: Your attacker's IP addressREVERSE_PORT: The port on which your listener is runningTARGET_URL: The vulnerable endpoint to attackWEBSOCKET_URL: The WebSocket URL to hijackRun the script to exploit the vulnerability and establish a reverse shell.
Start your netcat listener on the specified port:
nc -lvnp <REVERSE_PORT>
To protect against this vulnerability:
lo_export to trusted users only.This exploit is intended for educational purposes only. Ensure that you have explicit permission before testing any system with this exploit. Unauthorized access to computer systems is illegal.