CVE-2025-60797: phppgadmin contains a SQL injection vulnerability
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.
Other sources
phppgadmin contains a SQL injection vulnerability
— Packagist
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60797?
CVE-2025-60797 has been rated as critical due to the potential for SQL injection and unauthorized database access.
How do I fix CVE-2025-60797?
To fix CVE-2025-60797, upgrade phpPgAdmin to version 7.13.1 or later where the SQL injection vulnerability has been mitigated.
What systems are affected by CVE-2025-60797?
CVE-2025-60797 affects phpPgAdmin versions prior to 7.13.1, specifically 7.13.0 and earlier versions.
What type of vulnerability is CVE-2025-60797?
CVE-2025-60797 is categorized as a SQL injection vulnerability due to unsafe execution of user-supplied SQL queries.
Can CVE-2025-60797 lead to data breaches?
Yes, CVE-2025-60797 can lead to data breaches as attackers can execute arbitrary SQL commands against the database.