RCE in Veeam Backup & Replication via interval/order parameter

Repository contains a minimal proof-of-exploitation for a command injection vulnerability in PostgreSQL’s pg_backup extension affecting PostgreSQL 15.x (<15.7) and 16.x (<16.3). Structure: - README.md: States affected versions and describes unsanitized user-supplied parameters in pg_backup leading to OS command execution as the PostgreSQL user. - exploit.py: Python script using psycopg2 to authenticate to a PostgreSQL instance (host "target", db "postgres", user "backup_operator") and call pg_backup() with a crafted argument that appends a shell command using ';'. The included payload attempts a bash reverse shell to 192.168.1.10:4444. - exploit.sql: Standalone SQL demonstrating the same injection technique, using curl to download and execute http://attacker.com/backdoor.sh. Capabilities: - Remote exploitation over the PostgreSQL protocol using valid credentials. - Arbitrary command execution on the database host via argument injection into pg_backup. - Demonstrated post-exploitation actions: reverse shell callback and remote script download/execute. Notable observables/fingerprintable targets: - Reverse shell endpoint: 192.168.1.10:4444 - HTTP payload host: http://attacker.com/backdoor.sh - Local paths used in payloads: /tmp and /dev/tcp/192.168.1.10/4444