Security researchers at Rapid7 have uncovered that threat actors who exploited BeyondTrust’s software in December 2024 also leveraged a previously unknown SQL injection vulnerability in PostgreSQL’s psql tool. The newly discovered flaw, designated as CVE-2025-1094 with a CVSS score of 8.1, enables attackers to achieve arbitrary code execution through the tool’s meta-commands.

The investigation revealed that successful exploitation of BeyondTrust’s CVE-2024-12356 vulnerability required the concurrent exploitation of the PostgreSQL flaw to achieve remote code execution. The vulnerability exists in PostgreSQL’s handling of invalid UTF-8 characters, allowing attackers to execute shell commands through the “!” shortcut command.

PostgreSQL has released patches for multiple versions:
– Version 17.3
– Version 16.7
– Version 15.11
– Version 14.16
– Version 13.19

In related developments, CISA has added SimpleHelp remote support software vulnerability (CVE-2024-57727) to its Known Exploited Vulnerabilities catalog, with federal agencies required to implement fixes by March 6, 2025.