The DALIBO PostgreSQL Anonymizer contains an SQL injection vulnerability where a user with CREATE TABLE privileges can embed malicious code in a column identifier. When a superuser invokes the k-anonymity function, this code executes with superuser privileges, leading to privilege escalation. PostgreSQL 14 and earlier or upgraded instances are more vulnerable due to default permissions. PostgreSQL 15+ mitigates risk by revoking CREATE TABLE permission on the public schema by default, limiting exploitability to users explicitly granted this privilege. The issue is resolved in PostgreSQL Anonymizer 3.1.0 and subsequent releases.

Successful exploitation allows privilege escalation to superuser level via SQL injection, resulting in full control over the database instance. This can compromise confidentiality, integrity, and availability of the database. The impact is rated medium with a CVSS score of 6.8. The vulnerability is more easily exploited on PostgreSQL 14 or upgraded instances due to default permissions. PostgreSQL 15 and later reduce the attack surface by restricting schema creation permissions.

Upgrade to PostgreSQL Anonymizer version 3.1.0 or later, where this vulnerability is fixed. For PostgreSQL 15 and later, the default revocation of CREATE TABLE permission on the public schema reduces risk, but users should ensure that only trusted users have CREATE TABLE privileges. Patch status is not explicitly stated beyond the fixed version; therefore, verify with the vendor advisory for the latest remediation guidance.