CVE-2025-60797
📋 TL;DR
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in the data export functionality. Authenticated attackers can execute arbitrary SQL commands through unsanitized user input, potentially compromising the PostgreSQL database. This affects all deployments using vulnerable phpPgAdmin versions.
💻 Affected Systems
- phpPgAdmin
📦 What is this software?
Phppgadmin by Phppgadmin Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, privilege escalation to database superuser, and potential server compromise via PostgreSQL extensions.
Likely Case
Data exfiltration, privilege escalation within the database, and potential denial of service.
If Mitigated
Limited impact if proper network segmentation, database user privilege restrictions, and input validation are in place.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained. Public proof-of-concept demonstrates SQL injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.14.0 or later
Vendor Advisory: https://github.com/phppgadmin/phppgadmin/security/advisories
Restart Required: No
Instructions:
1. Backup current phpPgAdmin installation. 2. Download latest version from official repository. 3. Replace vulnerable files with patched version. 4. Verify dataexport.php line 118 uses parameterized queries.
🔧 Temporary Workarounds
Disable data export functionality
linuxRemove or restrict access to dataexport.php file
mv /path/to/phppgadmin/dataexport.php /path/to/phppgadmin/dataexport.php.disabled
Input validation filter
allAdd input validation before SQL execution in dataexport.php
Add: if (!preg_match('/^SELECT\s+/i', $_REQUEST['query'])) { die('Invalid query'); } before line 118
🧯 If You Can't Patch
- Implement strict network access controls to limit phpPgAdmin access to trusted IPs only
- Use database user accounts with minimal privileges (no superuser access) for phpPgAdmin connections
🔍 How to Verify
Check if Vulnerable:
Check if dataexport.php line 118 contains: $data->conn->Execute($_REQUEST['query']) without parameterizationCheck Version:
grep 'Version' /path/to/phppgadmin/CHANGELOG or check phpPgAdmin interface footerVerify Fix Applied:
Verify dataexport.php line 118 uses prepared statements or parameterized queries instead of direct $_REQUEST execution📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in PostgreSQL logs from phpPgAdmin user
- Multiple failed login attempts followed by dataexport.php access
Network Indicators:
- HTTP POST requests to dataexport.php with SQL payloads in query parameter
SIEM Query:
source="web_access.log" AND uri="/dataexport.php" AND (method="POST" OR params CONTAINS "SELECT" OR params CONTAINS "UNION")