PHP ext-pgsql Backslash-Escaping SQL Injection

This repository is a compact proof-of-concept for CVE-2026-17543, a critical SQL injection flaw in PHP's procedural PostgreSQL extension (ext/pgsql). The exploit is implemented in a single executable PHP script, poc.php, with Docker artifacts provided to reproduce the issue in an isolated environment. Repository structure: - poc.php: Main exploit/demo script. Connects to PostgreSQL using PGCONN or a localhost fallback, creates a users table, inserts seed rows, and demonstrates two exploit paths. - Dockerfile: Builds a vulnerable PHP CLI container (php:8.4.23-cli), installs libpq/pgsql support, copies poc.php, and runs it. - docker-compose.yml: Starts PostgreSQL 16 and the vulnerable PHP container, wiring PGCONN to the db service. - README.md: Documents the vulnerability, affected versions, payloads, expected output, and usage. Exploit capabilities: 1. Data exfiltration via pg_select(): The script uses payload zzz\' OR 1=1 -- to exploit vulnerable quoting behavior. On affected PHP versions, generated SQL uses E'...' and the backslash escapes a quote, allowing OR 1=1 to execute and return all rows. 2. Privilege escalation via pg_insert(): The payload eve\', true) -- is injected into the name field while admin is nominally set to false. On vulnerable builds, the injected SQL alters the VALUES clause so admin becomes true. 3. SQL visibility for verification: The script calls pg_select() and pg_insert() with PGSQL_DML_STRING to print the generated SQL, making the vulnerable E'...' quoting behavior directly observable. 4. Live execution against a database: After printing the generated SQL, it executes the insert and queries the resulting row to confirm whether admin was forced to true. The exploit is operational rather than merely descriptive: it performs real database operations and demonstrates successful exploitation when run on a vulnerable PHP build. It is not a framework module and not just a detector, although it also implicitly distinguishes patched from vulnerable behavior by comparing query results and generated SQL.