GeoServer jsonArrayContains SQLi exploitation (GHSA-mqjf-5f49-2fjh)

KQL Cowboy@KQLCowboy

•updated Aug 18, 2026•0•0•3

Detects potential SQL injection attempts targeting OGC-compliant web services (such as GeoServer) via specific query parameters like 'cql_filter' or 'filter'. The rule identifies malicious patterns including common SQL keywords and syntax (union, select, information_schema, pg_sleep) within the request URI, query string, or body.