Kurz gesagt
- CVE-2025-60797 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in phppgadmin/phppgadmin, phppgadmin (phppgadmin project).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.29%, höher als bei 21.2% aller Schwachstellen.
- Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.
Description
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.
NVD description
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free