CVE-2025-60799
📋 TL;DR
phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability that allows attackers to manipulate session variables by controlling parameters like 'subject', 'server', 'database', and 'queryid'. This can lead to session poisoning, stored cross-site scripting, or unauthorized access to sensitive session data. All users running affected versions of phpPgAdmin are vulnerable.
💻 Affected Systems
- phpPgAdmin
📦 What is this software?
Phppgadmin by Phppgadmin Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could poison user sessions with malicious SQL queries leading to stored XSS attacks, session hijacking, or unauthorized access to database management functions.
Likely Case
Session manipulation allowing attackers to store arbitrary SQL in user sessions, potentially leading to stored XSS attacks against other users.
If Mitigated
Proper input validation and access controls would prevent parameter manipulation, limiting impact to intended functionality.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.14.0 or later
Vendor Advisory: https://github.com/phppgadmin/phppgadmin/security/advisories
Restart Required: No
Instructions:
1. Download latest version from official repository. 2. Replace sql.php with patched version. 3. Verify $_SESSION variable validation is implemented.
🔧 Temporary Workarounds
Input Validation Filter
linuxAdd parameter validation to sql.php to restrict allowed values
sed -i '68,76s/.*/\/\/ Add validation logic here/' /path/to/sql.php
🧯 If You Can't Patch
- Restrict access to phpPgAdmin to trusted networks only
- Implement web application firewall rules to block suspicious parameter manipulation
🔍 How to Verify
Check if Vulnerable:
Check if sql.php lines 68-76 lack proper validation of 'subject', 'server', 'database', 'queryid' parametersCheck Version:
grep 'Version' /path/to/phpPgAdmin/version.phpVerify Fix Applied:
Verify sql.php now validates user input before storing in $_SESSION['sqlquery']📡 Detection & Monitoring
Log Indicators:
- Unusual parameter values in sql.php requests
- Multiple SQL query storage attempts
Network Indicators:
- HTTP POST requests to sql.php with manipulated parameters
SIEM Query:
source="web_logs" AND uri="/sql.php" AND (param="subject" OR param="server" OR param="database" OR param="queryid") AND value!="expected_pattern"