Loading vulnerability…
CVE-2019-9193 is a vulnerability in PostgreSQL versions 9.3 through 11.2, where the 'COPY TO/FROM PROGRAM' feature allows database superusers and users in the 'pg_execute_server_program' group to execute arbitrary operating system commands as the database process user. This feature is enabled by default and can be abused on all major operating systems (Windows, Linux, macOS). Exploitation requires authentication, either via valid credentials or SQL injection, and can be performed manually or via automated tools such as a Metasploit module. The vulnerability is analogous to the historical 'xp_cmdshell' issue in Microsoft SQL Server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
6 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
Repository contains a single Python exploit script (CVE-2019-9193.py) and a short README with usage examples. The script uses psycopg2 to authenticate to a remote PostgreSQL instance (defaults: 127.0.0.1:5432, database template1, user/password postgres/postgres), checks the server version via `SELECT version()`, and if a `-c/--command` is provided, achieves OS command execution by creating a randomly named table and invoking `COPY <table> FROM PROGRAM '<command>'`, then selecting and printing the resulting output. It attempts cleanup by dropping the created table, including in an exception path. Overall purpose: authenticated RCE against PostgreSQL instances where `COPY ... FROM PROGRAM` is usable, with command output retrieval and basic operational flow (connect → version check → execute → cleanup).
This repository contains a Python exploit script (CVE-2019-9193.py) and a README.md for CVE-2019-9193, a vulnerability in PostgreSQL versions 9.3 through 11.7 that allows authenticated remote code execution. The exploit connects to a target PostgreSQL server using user-supplied credentials and executes arbitrary system commands via the 'COPY FROM PROGRAM' SQL feature, retrieving the output. The script checks the PostgreSQL version to ensure it is vulnerable, then creates a temporary table, executes the command, fetches the output, and cleans up. The README provides usage instructions and example output. The exploit requires network access to the PostgreSQL server and valid credentials. The main attack vector is network-based, targeting the PostgreSQL service (default port 5432). No hardcoded external URLs or IPs are present beyond the default localhost/127.0.0.1 examples.
This repository contains a single Python exploit script (GenPostgresRCEExploit.py) targeting CVE-2019-9193, an authenticated remote code execution vulnerability in PostgreSQL versions 9.3 through 11.7. The exploit requires valid credentials to connect to the target PostgreSQL server and leverages the 'COPY ... FROM PROGRAM' SQL command to execute arbitrary system commands on the server. The script first checks the PostgreSQL version to ensure it is vulnerable, then creates a temporary table, executes the user-supplied command, retrieves the output, and cleans up the temporary table. The repository also includes a README.md with detailed usage instructions and examples, a requirements.txt specifying the psycopg2 dependency, and an MIT license file. The exploit is a proof-of-concept and does not include advanced payloads or automation for post-exploitation. The main attack vector is network-based, requiring access to the PostgreSQL service (default port 5432) and valid authentication credentials.
This repository contains a single Python exploit script (GenPostgresRCEExploit.py) targeting CVE-2019-9193, an authenticated remote code execution vulnerability in PostgreSQL versions 9.3 through 11.7. The exploit requires valid credentials to connect to the target PostgreSQL server and leverages the 'COPY ... FROM PROGRAM' SQL command to execute arbitrary system commands on the server. The script checks the server version for vulnerability, connects using user-supplied parameters (IP, port, database, username, password), and executes a user-specified command, returning its output. The repository also includes a README in both English and Russian, a requirements.txt specifying the psycopg2 library, and an MIT license. The exploit is a proof-of-concept and is not weaponized, but demonstrates the core vulnerability and its impact.
This repository contains a Python proof-of-concept exploit for CVE-2019-9193, targeting PostgreSQL versions 9.3 through 12.3. The exploit leverages the 'COPY ... FROM PROGRAM' SQL command, which allows an authenticated user to execute arbitrary system commands on the database server. The main script, 'cve-2019-9193.py', accepts command-line arguments for the target IP, port, database name, user credentials, and the system command to execute. Upon successful authentication, it checks the PostgreSQL version and, if a command is provided, creates a temporary table, executes the command via the vulnerable SQL feature, retrieves the output, and cleans up. The exploit requires valid database credentials and network access to the PostgreSQL server. The README provides context, references, and usage examples. No hardcoded external endpoints are present; the script is designed to be run by an attacker who specifies the target. The repository is structured simply, with one exploit script and a README.
This repository contains a Python exploit script (portgres_rce.py) targeting CVE-2019-9193, a vulnerability in PostgreSQL that allows code execution via the 'COPY FROM PROGRAM' feature when used by a superuser or a user in the 'pg_execute_server_program' group. The exploit works by connecting to a vulnerable PostgreSQL server and executing a Perl one-liner to establish a reverse shell from the server to the attacker's machine. The attacker is prompted for the target (RHOST, RPORT) and their own (LHOST, LPORT) connection details. The script sets up a listener on the attacker's machine and, upon successful exploitation, provides an interactive shell for arbitrary command execution on the server. The repository is minimal, with only one code file, and is focused solely on this exploit. No detection or fake code is present.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A PostgreSQL remote code execution issue referenced in the context of abuse of COPY TO/FROM PROGRAM, enabling attacker-controlled command execution via the database process.
A disputed PostgreSQL arbitrary code execution issue involving pg_execute_server_program privileges, used by DreamBus after successful PostgreSQL authentication.
A PostgreSQL remote code execution vulnerability listed as one of the named exploits used by Sysrv.
A disputed PostgreSQL remote code execution issue tied to the "copy from program" feature, which allows shell command execution on the server when an attacker has or obtains sufficient database privileges; the article describes it being weaponized by the PGMiner cryptojacking botnet.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.