CVE-2025-2945

published 2025-04-03

CVE-2025-2945: Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints…

Priority P2 77 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules).

The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.

This issue affects pgAdmin 4: before 9.2.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
pgadmin.org	pgadmin_4	< 9.2	9.2
pgadmin	pgadmin_4	< 9.2	9.2

Detection & IOCs extracted from sources · hover to see the quote

url /sqleditor/query_tool/download/↗

url /cloud/deploy↗

cookie pga4_session=↗

snort

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS PostgreSQL pgAdmin4 Authenticated Remote Code Execution (CVE-2025-2945) M1"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/sqleditor/query_tool/download/"; fast_pattern; startswith; http.cookie; content:"pga4_session|3d|"; http.request_body; content:"|22|query_committed|22 3a|"; content:"|22|"; within:2; reference:url,py0zz1.tistory.com/entry/Remote-Code-Execution-Vulnerability-in-pgAdmin-CVE-2025-2945; reference:cve,2025-2945; classtype:web-application-attack; sid:2061374; rev:1; metadata:affected_product PostgreSQL, attack_target Server, created_at 2025_04_08, cve CVE_2025_2945, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2025_04_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

snort

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS PostgreSQL pgAdmin4 Authenticated Remote Code Execution (CVE-2025-2945) M2"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cloud/deploy"; fast_pattern; startswith; http.cookie; content:"pga4_session|3d|"; http.request_body; content:"|22|high_availability|22 3a|"; content:"exec|28|"; distance:0; reference:url,py0zz1.tistory.com/entry/Remote-Code-Execution-Vulnerability-in-pgAdmin-CVE-2025-2945; reference:cve,2025-2945; classtype:web-application-attack; sid:2061375; rev:1; metadata:affected_product PostgreSQL, attack_target Server, created_at 2025_04_08, cve CVE_2025_2945, deployment Perimeter, deployment Internal, signature_severity Major, tag Exploit, updated_at 2025_04_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

bytes

|22|query_committed|22 3a|

bytes

|22|high_availability|22 3a|

bytes

exec|28|

• → Exploit targets POST /sqleditor/query_tool/download — inspect the `query_committed` parameter in the request body for eval-injectable payloads (e.g., Python expressions or exec() calls). ↗
• → Exploit targets POST /cloud/deploy — inspect the `high_availability` parameter in the request body for eval-injectable payloads; Snort rule keys on `exec(` immediately following the parameter value. ↗
• → Both attack vectors require an authenticated session; presence of the `pga4_session` cookie is a prerequisite indicator — correlate POST requests to the two vulnerable endpoints with a valid pga4_session cookie. ↗
• → A Metasploit module exists for this CVE targeting authenticated pgAdmin instances; look for automated exploitation patterns such as rapid sequential requests to establish a DB connection, obtain a transaction ID, then POST to the download endpoint. ↗

• · Exploitation requires valid pgAdmin credentials AND valid database credentials to initialize a session and obtain a transaction ID before the RCE payload can be delivered. ↗
• · Vulnerability only affects pgAdmin 4 versions before 9.2; instances already upgraded to 9.2+ are not affected and detections may generate false positives if the parameter is used legitimately in patched versions. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94