Vulnerability record · CVE-2013-1899 · published 4 April 2013
CVE-2013-1899: PostgreSQL argument injection via hyphen-prefixed database name
Postgresql · Postgresql
PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 mishandle a connection request whose database name begins with a hyphen, allowing argument injection into the server process. This can corrupt files (denial of service) and lets remote authenticated users alter configuration settings and execute arbitrary code.
Description
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a "-" (hyphen).
AV:N/AC:L/Au:S/C:P/I:P/A:P
Automated analysis
high priorityThe flaw allows configuration tampering and arbitrary code execution by an authenticated remote user, and EPSS is very high despite no KEV listing.
What it is
PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 mishandle a connection request whose database name begins with a hyphen, allowing argument injection into the server process. This can corrupt files (denial of service) and lets remote authenticated users alter configuration settings and execute arbitrary code.
Impact
An attacker can corrupt server files to cause a denial of service, and an authenticated attacker can modify PostgreSQL configuration and execute arbitrary code on the database host.
Attack surface
Reached over the network via a crafted connection request containing a database name starting with "-"; the CVSS vector (AV:N/AC:L/Au:S) indicates network access with low complexity but requires authentication, and no user interaction is needed.
Exploitation
Not listed in CISA KEV and no exploit tags appear in the references, but EPSS is high (0.54312, 98.9th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Upgrade to PostgreSQL 9.2.4, 9.1.9, or 9.0.13 (or later) as applicable.
- Apply the vendor and distribution advisories (PostgreSQL, Ubuntu USN-1789-1, Debian DSA-2658, Fedora, openSUSE, Mandriva, Apple) for packaged builds.
- Restrict network access to PostgreSQL ports to trusted hosts and require strong authentication to limit the authenticated attack path.
- Audit database roles and connection privileges, removing unnecessary login rights that enable the authenticated code execution path.
Detection
- Monitor PostgreSQL connection logs for database names beginning with a hyphen or otherwise malformed connection parameters.
- Alert on unexpected changes to postgresql.conf or other server configuration files.
- Watch for unexpected child processes or command execution spawned by the PostgreSQL server process.
- Check for file corruption or integrity failures in PostgreSQL data directories.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-1899 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-1899), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
