Postgresql Global Development Group
An unauthenticated SQL injection flaw exists in the database abstraction API of Drupal Core, specifically within the PostgreSQL `EntityQuery` condition handler. The issue occurs when attacker-controlled PHP array keys, such as `filter[...][condition][value][malicious key]`, are concatenated directly into SQL identifiers without proper sanitization. This vulnerability exclusively affects sites using PostgreSQL databases. Remote anonymous users can exploit this to achieve full database access, exfiltrate sensitive data, escalate privileges to Administrator, and potentially execute arbitrary shell commands on the host server via Remote Code Execution (RCE) if database permissions are misconfigured (e.g., allowing `COPY FROM PROGRAM`). Over 15,000 attack probes against approximately 6,000 sites across 65 countries have been detected, with gaming and financial services being primary targets.