CVE-2025-60798: SQL Injection
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60798?
CVE-2025-60798 is considered a critical SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries.
How do I fix CVE-2025-60798?
To fix CVE-2025-60798, upgrade phpPgAdmin to version 7.13.1 or later, which includes proper input sanitization.
Which versions of phpPgAdmin are affected by CVE-2025-60798?
CVE-2025-60798 affects phpPgAdmin versions 7.13.0 and earlier.
What type of attack can be performed using CVE-2025-60798?
An attacker can exploit CVE-2025-60798 to execute unauthorized SQL queries, potentially leading to data exposure or manipulation.
Is user authentication required to exploit CVE-2025-60798?
Yes, an attacker must be authenticated to exploit CVE-2025-60798 due to the nature of the vulnerability.