GHSA-g6xh-wrpf-v6j6

phppgadmin contains a SQL injection vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-60798

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	phppgadmin/phppgadmin	<= 7.13.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-60798 advisory
https://github.com/phppgadmin/phppgadmin package
https://github.com/phppgadmin/phppgadmin/blob/master/display.php#L396 web
https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60797.md web
https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60798.md web