CVE-2025-60799

Vulnerability

Description phpPgAdmin 7.13.0 and earlier suffer from an incorrect access control vulnerability in the sql.php file, specifically at lines 68-76 [1][2]. The application accepts user-controlled parameters such as 'subject', 'server', 'database', and 'queryid' and stores them directly into the $_SESSION['sqlquery'] variable without proper validation or access control checks [1]. This allows an attacker to inject arbitrary SQL query strings into the session.

Exploitation

An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the phpPgAdmin instance, manipulating the aforementioned parameters [1]. The attack can be performed without authentication, as the application fails to enforce access control on these parameters [1]. The attacker only needs network access to the phpPgAdmin web interface.

Impact

Successful exploitation can lead to session poisoning, where the attacker's malicious SQL query is stored in the session [3]. This can result in stored cross-site scripting (XSS) if the stored query is later rendered unsafely, unauthorized access to sensitive session data, or stored SQL injection attacks [3][1]. The impact is increased if the application relies on session data for authorization decisions.

Mitigation

As of the publication date, no official patch has been released [4]. The affected versions are 7.13.0 and earlier. Users are advised to apply input validation to the vulnerable parameters or restrict access to the sql.php endpoint until a fix is available [1][3]. The phpPgAdmin project may release an update in the future [4].