Drupal PostgreSQL SQL Injection: From SELECT-Only to RCE
blog.lexfo.fr

Turning a SELECT-only PostgreSQL SQL injection into remote command execution when the injected role is a PostgreSQL superuser.