CVE-2018-25088: 
Python vulnerability analysis and mitigation

A critical SQL injection vulnerability was discovered in Blue Yonder postgraas_server versions up to 2.0.0b2. The vulnerability affects the _create_pg_connection/create_postgres_db function in the PostgreSQL Backend Handler component (postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py). The vulnerability was disclosed on July 18, 2023 and assigned identifier CVE-2018-25088 (NVD).

The vulnerability allows manipulation of SQL commands through improper neutralization of special elements in the PostgreSQL Backend Handler. The severity is rated as CRITICAL with a CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) according to NVD assessment (NVD).

If exploited, this SQL injection vulnerability could allow an attacker to manipulate database queries, potentially leading to unauthorized access, data theft, or manipulation of the database contents (NVD).

The vulnerability was fixed in version 2.0.0 of postgraas_server. Users should upgrade to this version or later to address the issue. The fix involves hardening the database creation against SQL injections through proper parameter handling, as implemented in commit 7cd8d016edc74a78af0d81c948bfafbcc93c937c (GitHub Patch).