Description

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter() treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gml_<item>_type=Integer are configured, but it does not verify that attacker-controlled CGI qstring or OGC API Features featureId input is a numeric literal. The unquoted input is concatenated into the generated PostgreSQL/PostGIS predicate, allowing an unauthenticated remote attacker with access to an affected query endpoint to bypass predicates, enumerate unintended records, perform boolean-based or time-based SQL injection, and increase database load. The issue does not by itself establish database modification capabilities. This issue is fixed in version 8.6.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-17T21:17:15.260Z",
  "pubdate": "2026-09-17T21:17:15.260Z",
  "executiveSummary": "MapServer versions prior to 8.6.4 contain a critical SQL injection vulnerability within the PostGIS runtime filter translation mechanism. The flaw resides in how the application processes filteritem parameters when configured with specific metadata types like gml_<item>_type=Integer. By failing to validate that user-supplied input—specifically via CGI qstring or OGC API Features featureId—is a strictly numeric literal, the system inadvertently permits the concatenation of unquoted, attacker-controlled strings into the generated PostgreSQL predicate.\nThis vulnerability allows an unauthenticated remote attacker to bypass intended query logic, perform unauthorized data enumeration, and execute boolean-based or time-based SQL injection attacks. While the vulnerability does not directly facilitate database modification, it poses significant risks regarding unauthorized data disclosure and potential denial-of-service conditions through database load exhaustion. The vulnerability is highly exploitable in public-facing MapServer instances that utilize PostGIS layers with Integer metadata configurations, requiring no prior authentication or administrative privileges to execute the injection.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization and type enforcement within the msPostGISLayerTranslateFilter() function located in src/mappostgis.cpp. When a MapServer layer is configured as CONNECTIONTYPE POSTGIS and includes metadata defining a filteritem as an integer (e.g., gml_<item>_type=Integer), the translation logic expects a numeric value. However, the implementation fails to strictly validate the input provided through the CGI query string or OGC API featureId parameters against numeric constraints before concatenating the value into the SQL WHERE clause.\nThe exploitation flow begins when an attacker identifies an endpoint interacting with a PostGIS-backed layer. By manipulating the query parameters, the attacker provides a malicious payload instead of a legitimate integer. Because the application treats the input as numeric but neglects to sanitize it as such, the payload is concatenated directly into the dynamically generated SQL query sent to the PostgreSQL backend. Specifically, because the input is left unquoted in the resulting predicate, the database engine interprets the malicious string as part of the SQL command rather than a literal value.\nThis behavior enables an attacker to inject arbitrary SQL fragments. For instance, an attacker can append boolean operators to enumerate records, use time-delay functions to confirm the presence of data, or inject complex subqueries to exfiltrate information from other tables within the database schema. Since the vulnerability allows for the modification of the predicate structure, attackers can bypass security filters intended to limit result sets, effectively granting access to data they are not authorized to view.\nThe vulnerability affects MapServer versions prior to 8.6.4. It is remotely exploitable without authentication, meaning any network-accessible MapServer instance using the affected PostGIS translation logic is susceptible to blind SQL injection techniques. The lack of proper parameterization or input validation within src/mappostgis.cpp allows for significant post-exploitation impact, including large-scale record enumeration and performance degradation caused by injecting resource-intensive queries, though it does not provide an direct mechanism for data insertion, update, or deletion."
}