#VU111761 OS Command Injection in PostgreSQL - CVE-2007-3278
Published: June 23, 2025
Vulnerability identifier: #VU111761
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2007-3278
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
PostgreSQL
PostgreSQL
Software vendor:
PostgreSQL Global Development Group
PostgreSQL Global Development Group
Description
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation in dblink. A remote attacker with ability to manipulate the connection string can pass specially crafted input to the application and execute arbitrary OS commands on the target system.
Remediation
Install updates from vendor's website.