GHSA-927w-vq5c-8gc3
phppgadmin contains a SQL injection vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | phppgadmin/phppgadmin | <= 7.13.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.
References
External links from the advisory. They lead to third-party sites.