CVE-2025-60797

Katalog CVE

CVSS 6.5 · Medium EPSS 0,27%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada phppgadmin project phppgadmin. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.

Rincian

Terbit di NVD

20 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60797.md advisory pihak ketiga
• https://github.com/phppgadmin/phppgadmin/blob/master/dataexport.php#L118 product