Executive brief
MapServer is a web-based GIS application framework that connects to PostGIS databases to serve geospatial data. A flaw in its query filter handling allows unauthenticated attackers to inject SQL code through crafted inputs, enabling unauthorized data access, record enumeration, and database overload without requiring login credentials.
Technical details
MapServer's PostGIS runtime filter translator (msPostGISLayerTranslateFilter in src/mappostgis.cpp) fails to validate that CGI query parameters or OGC API Features featureId values are numeric literals when the metadata declares a filter item as Integer type. Attacker-controlled input is concatenated directly into the PostgreSQL predicate without quoting, enabling SQL injection. An unauthenticated remote attacker with network access to an affected query endpoint can exploit this to bypass predicates, enumerate unintended database records, perform boolean-based or time-based SQL injection, and increase database load. The vulnerability does not directly enable database modification. This issue is fixed in version 8.6.4 (commits 65f1b53 and bd59d49).
Affected products
- MapServer MapServer prior to 8.6.4
Timeline
- 2026-09-17: disclosed