CVE-2025-60797 phppgadmin contains a SQL injection vulnerability
An authenticated attacker can execute arbitrary SQL commands via the query parameter in dataexport.php, leading to database compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-60797?
CVE-2025-60797 is a medium-severity SQL injection vulnerability in n/a, published on 20 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.
Weakness: CWE-89
Which versions are affected by CVE-2025-60797?
2 open source packages ship an affected version, including phppgadmin/phppgadmin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phppgadmin/phppgadmin Packagist | All versions to 7.13.0 | None |
phppgadmin/phppgadmin Packagist | All versions to 7.13.0 | None |
Products include Phppgadmin Project Phppgadmin.
How do I fix CVE-2025-60797?
No fix has been published for CVE-2025-60797 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-60797 being exploited?
There is no known exploitation of CVE-2025-60797 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2025-60797, GHSA-927w-vq5c-8gc3, UBUNTU-CVE-2025-60797.