CyberRota Analysis
AI-GeneratedElectric Postgres Sync versions prior to 1.6.10 are vulnerable to an information disclosure flaw that enables attackers to infer the values of excluded columns by manipulating subset where clause conditions. This vulnerability allows unauthorized users to deduce sensitive data from responses, effectively circumventing column-based access controls. Organizations utilizing affected versions should prioritize patching to mitigate the risk of sensitive data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduce sensitive field data even though those columns are not returned in shape responses, bypassing column-based access restrictions.