CVE-2025-60797: SQL Injection
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60797?
CVE-2025-60797 has been rated as critical due to the potential for SQL injection and unauthorized database access.
How do I fix CVE-2025-60797?
To fix CVE-2025-60797, upgrade phpPgAdmin to version 7.13.1 or later where the SQL injection vulnerability has been mitigated.
What systems are affected by CVE-2025-60797?
CVE-2025-60797 affects phpPgAdmin versions prior to 7.13.1, specifically 7.13.0 and earlier versions.
What type of vulnerability is CVE-2025-60797?
CVE-2025-60797 is categorized as a SQL injection vulnerability due to unsafe execution of user-supplied SQL queries.
Can CVE-2025-60797 lead to data breaches?
Yes, CVE-2025-60797 can lead to data breaches as attackers can execute arbitrary SQL commands against the database.