CVE-2025-1094 Exploitation, a Critical SQL Injection Vulnerability in PostgreSQL That Can Lead to Arbitrary Code Execution  – Source: socprime.com

A novel PostgreSQL flaw, CVE-2025-1094, has hit the headlines. Defenders recently revealed that attackers responsible for weaponizing a BeyondTrust zero-day RCE are also in charge of abusing another critical security issue in PostgreSQL.

SOC Prime Platform for collective cyber defense helps organizations proactively detect vulnerability exploitation attempts using relevant context-enriched Sigma rules compatible with dozens of SIEM, EDR, and Data Lake technologies. Click Explore Detections to instantly get curated detection algorithms addressing CVE exploits and risk-optimize your organization’s cybersecurity posture.

Explore Detections

Analysis of CVE-2025-1094 Vulnerability

Defenders spotted a critical SQL injection vulnerability, CVE-2025-1094, in the PostgreSQL psql tool with a CVSS score reaching 8.1.

The security issue emerged during the investigation into CVE-2024-12356, impacting BeyondTrust. In every single test scenario, weaponizing CVE-2024-12356 was accompanied by taking advantage of CVE-2025-1094 to gain RCE. Although the vendor patched the former security issue at the end of 2024, effectively blocking both vulnerabilities, Rapid7’s report to PostgreSQL finally exposed and set the stage to resolve the root cause of CVE-2025-1094.

CVE-2025-1094 originates from PostgreSQL’s handling of invalid UTF-8 characters, allowing threat actors to weaponize an SQL injection using the “!” shortcut command to abuse shell commands. The latter meta-command lets attackers execute OS shell commands, which they could misuse through CVE-2025-1094 to gain system control. On the other hand, the same SQL injection could enable the execution of arbitrary SQL statements. As potential CVE-2025-1094 mitigation measures, PostgreSQL maintainers addressed the issue through collaborative efforts, releasing fixes in versions 17.3, 16.7, 15.11, 14.16, and 13.19.

By relying on SOC Prime’s complete product suite for AI-powered detection engineering, automated threat hunting, and advanced threat detection, organizations can minimize the risks of vulnerability exploitation, elevate their defenses at scale, and build a robust cybersecurity strategy tailored for a next-gen SOC. To learn more about advanced automation, real-time intelligence, and innovative detection strategies for enterprise security, register for our upcoming online webinar here.

Was this article helpful?

Like and share it with your peers.