logo

Database

SQL injection In phppgadmin/phppgadmin

Description

phppgadmin contains a SQL injection vulnerability phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version

Aliases

1. CVE-2025-607972. NVD-2025-607973. OSV-DEBIAN-2025-607974. OSV-2025-607975. GCVE-2025-607976. SECURITY-TRACKER-CVE-2025-60797

References

1. https://github.com/phppgadmin/phppgadmin/blob/master/dataexport.php#L1182. https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60797.md

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.