Skip to content

Comment on Two Active Record SQL Injection Vulnerabilities Affecting PostgreSQL

Comments

You should be able to see if you are vulnerable by running this query:

  select 
        cn.nspname as schema, 
        relname as table, 
        attname as column, 
        tn.nspname as type_schema, 
        typname as type_name 
    from pg_attribute a 
    inner join pg_class c on a.attrelid = c.oid 
    inner join pg_namespace cn on c.relnamespace = cn.oid 
    inner join pg_type t on a.atttypid = t.oid 
    inner join pg_namespace tn on t.typnamespace = tn.oid 
    where (t.typtype = 'r' or t.typname = 'bit' or t.typname = 'varbit');
AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.