PostgreSQL Vulnerability Exploited Alongside BeyondTrust Zero-Day in Targeted Attacks

Threat actors who were behind the exploitation of a zero-day vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products in December 2024 likely also exploited a previously unknown SQL injection flaw in PostgreSQL, according to findings from Rapid7.

The vulnerability, tracked as CVE-2025-1094 (CVSS score: 8.1), affects the PostgreSQL interactive tool psql.

“An attacker who can generate a SQL injection via CVE-2025-1094 can then achieve arbitrary code execution (ACE) by leveraging the interactive tool’s ability to run meta-commands,” security researcher Stephen Fewer said.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The cybersecurity company further noted that it made the discovery as part of its investigation into CVE-2024-12356, a recently patched security flaw in BeyondTrust software that allows for unauthenticated remote code execution.

Specifically, it found that “a successful exploit for CVE-2024-12356 had to include exploitation of CVE-2025-1094 in order to achieve remote code execution.”

In a coordinated disclosure, the maintainers of PostgreSQL released an update to address the problem in the following versions –

• PostgreSQL 17 (Fixed in 17.3)
• PostgreSQL 16 (Fixed in 16.7)
• PostgreSQL 15 (Fixed in 15.11)
• PostgreSQL 14 (Fixed in 14.16)
• PostgreSQL 13 (Fixed in 13.19)

The vulnerability stems from how PostgreSQL handles invalid UTF-8 characters, thus opening the door to a scenario where an attacker could exploit an SQL injection by making use of a shortcut command “\!”, which enables shell command execution.

“An attacker can leverage CVE-2025-1094 to perform this meta-command, thus controlling the operating system shell command that is executed,” Fewer said. “Alternatively, an attacker who can generate a SQL injection via CVE-2025-1094 can execute arbitrary attacker-controlled SQL statements.”

The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a security flaw impacting SimpleHelp remote support software (CVE-2024-57727, CVSS score: 7.5) to the Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fixes by March 6, 2025.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.