PT-2025-47583 · Unknown · Phppgadmin

CVE-2025-60798 · Publicado 2025-11-17 · Atualizado 2025-12-18

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpPgAdmin versions 7.13.0 and earlier

Description phpPgAdmin versions 7.13.0 and earlier contain a SQL injection issue in the display.php file at line 396. The application directly uses user-provided input from the query parameter in the $ REQUEST array within the browseQuery function without sufficient sanitization. An authenticated attacker can manipulate queries to execute arbitrary SQL commands, potentially compromising the entire database. The vulnerable parameter is query.

Recommendations Versions prior to 7.13.0 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2025-14887

CVE-2025-60798

GHSA-G6XH-WRPF-V6J6

Produtos afetados

Phppgadmin

Referências · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/60xxx/CVE-2025-60798.json · Exploit
• 🔥 https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60797.md · Exploit
• 🔥 https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60798.md · Exploit
• https://github.com/phppgadmin/phppgadmin/blob/master/display.php#L396 · Nota
• https://security-tracker.debian.org/tracker/CVE-2025-60798 · Aviso do Fabricante
• https://t.me/avleonovcom/1618 · Publicação no Telegram
• https://reddit.com/r/VulnMatter/comments/1p5s47k/resumen_diario_de_vulnerabilidades_24112025 · Publicação no Reddit
• https://twitter.com/VulmonFeeds/status/1991547898438222251 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-60798 · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1p5nvy1/resumen_diario_de_vulnerabilidades_24112025 · Publicação no Reddit
• https://twitter.com/CVEnew/status/1991531287866421460 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-60798 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-60798 · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1p6brge/resumen_diario_de_vulnerabilidades_25112025 · Publicação no Reddit
• https://ubuntu.com/security/CVE-2025-60798 · Aviso do Fabricante