logoalt Hacker News

logophobia • today at 9:14 PM • 2 replies • view on HN

Correct me if I'm wrong, but those all look like sql exploits. Don't those already require some sort of authenticated remote access. They are security issues, but calling them remote code exploitation make them seem more dangerous than they are.

These seem more like privilege escalation, you have access through a database account and use that to gain full access to the whole server. So an issue for multi-tenant databases mostly.


Replies

vfosnar • today at 9:26 PM

ppl host open Postgres instances, one I can think of is https://postpass.geofabrik.de/ where you can query OpenStreetMap data in a Postgres instance exposed over plain HTTP API

knorker • today at 9:19 PM

It's RCE even if it's not pre-auth.