CVE-2025-60798

Vulnerability

Description

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in the display.php script at line 396. The application passes user-controlled input from the $_REQUEST['query'] parameter directly to the browseQuery() function without any sanitization or parameterization [1][4]. This lack of input validation allows an attacker to inject malicious SQL statements into the database query.

Exploitation

An authenticated attacker can exploit this vulnerability by crafting a malicious query parameter in a request to display.php. Since the input is used directly in a SQL query, the attacker can manipulate the query structure to execute arbitrary SQL commands. The attack requires authentication to the phpPgAdmin interface, but no special privileges beyond a valid user account are needed [1][4].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands on the underlying PostgreSQL database. This can lead to complete database compromise, including data exfiltration, modification, deletion, and potential privilege escalation within the database context [1][4]. The impact is severe as it undermines the confidentiality, integrity, and availability of the database managed by phpPgAdmin.

Mitigation

As of the publication date, no patch has been released for this vulnerability. Users of phpPgAdmin 7.13.0 and earlier are advised to upgrade to a patched version 7.14.0 or later once available, or apply input sanitization and parameterized queries as a workaround. The vulnerability has been assigned CVE-2025-60798 and is publicly documented [1][4].