In MapServer versions before 8.6.4, the PostGIS runtime filter translation function msPostGISLayerTranslateFilter() in src/mappostgis.cpp incorrectly treats filter items as numeric based on metadata without verifying that attacker-controlled CGI query strings or OGC API Features featureId inputs are numeric literals. This unquoted input is concatenated into the generated PostgreSQL/PostGIS predicate, enabling unauthenticated remote attackers with access to the query endpoint to bypass predicates, enumerate unintended records, and conduct boolean- or time-based SQL injection attacks, thereby increasing database load. The vulnerability does not by itself allow database modification. The flaw is resolved in version 8.6.4.

An unauthenticated remote attacker can exploit this vulnerability to bypass intended query filters and enumerate unintended database records. The attacker can also perform boolean-based or time-based SQL injection attacks, which can increase the load on the database server. However, the vulnerability does not grant the ability to modify database contents.

This vulnerability is fixed in MapServer version 8.6.4. Users should upgrade to version 8.6.4 or later to remediate this issue. No other mitigation steps are indicated by the vendor advisory.