CyberRota Analysis
AI-GeneratedThe vulnerability affects the GeoTools Java library, specifically in versions prior to 33.6, 34.5, and 33.6, where the `jsonArrayContains` function can lead to SQL Injection when interacting with PostGIS DataStore. This critical flaw, which has a CVSS score of 9.8, allows attackers to execute arbitrary SQL commands, potentially compromising the integrity and confidentiality of the database. Organizations using affected versions of GeoTools with PostGIS 12 or higher should prioritize applying the available patches to mitigate this significant security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.