PT-2025-47582 · Unknown · Phppgadmin

Published 2025-11-17 · Updated 2025-12-18 · CVE-2025-60797

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpPgAdmin versions 7.13.0 and earlier

Description phpPgAdmin versions 7.13.0 and earlier contain a SQL injection issue in the dataexport.php file at line 118. The application directly executes user-supplied SQL queries from the $ REQUEST['query'] parameter without proper sanitization or parameterization using $data->conn->Execute($ REQUEST['query']). An authenticated attacker could exploit this to execute arbitrary SQL commands, potentially leading to database compromise, data theft, or privilege escalation. The vulnerable parameter is query.

Recommendations Versions prior to 7.13.0 should be updated.

Exploit

Fix

LPE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-14889

CVE-2025-60797

GHSA-927W-VQ5C-8GC3

Affected Products

Phppgadmin

References · 15

• 🔥 https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60797.md · Exploit
• https://cve.org/CVERecord?id=CVE-2025-60797 · Security Note
• https://bdu.fstec.ru/vul/2025-14889 · Security Note
• https://osv.dev/vulnerability/CVE-2025-60797 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60797 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-60797 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-60797 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-60797 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-60797 · Vendor Advisory
• https://github.com/phppgadmin/phppgadmin/blob/master/dataexport.php#L118 · Note
• https://twitter.com/CVEnew/status/1991531286851445057 · Twitter Post
• https://t.me/cveNotify/143606 · Telegram Post
• https://t.me/CVEtracker/37823 · Telegram Post
• https://t.me/avleonovcom/1618 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1991555578510946393 · Twitter Post