phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters ('subject', 'server', 'database', 'queryid') without proper validation or access control checks. Attackers can exploit this to store arbitrary SQL queries in $_SESSION['sqlquery'] by manipulating these parameters, potentially leading to session poisoning, stored cross-site scripting, or unauthorized access to sensitive session data.
References
| Link | Resource |
|---|---|
| https://github.com/phppgadmin/phppgadmin/blob/master/sql.php#L68-L76 | Product |
| https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60799.md | Third Party Advisory |
Configurations
History
25 Nov 2025, 19:08
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:phppgadmin_project:phppgadmin:*:*:*:*:*:*:*:* | |
| First Time |
Phppgadmin Project phppgadmin
Phppgadmin Project |
|
| References | () https://github.com/phppgadmin/phppgadmin/blob/master/sql.php#L68-L76 - Product | |
| References | () https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60799.md - Third Party Advisory |
20 Nov 2025, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-284 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
20 Nov 2025, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-20 15:17
Updated : 2025-11-25 19:08
NVD link : CVE-2025-60799
Mitre link : CVE-2025-60799
CVE.ORG link : CVE-2025-60799
JSON object : View
Products Affected
phppgadmin_project
- phppgadmin
CWE
CWE-284
Improper Access Control