{"id":"GHSA-927w-vq5c-8gc3","aliases":["CVE-2025-60797"],"title":"phppgadmin contains a SQL injection vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.","severity":"medium","score":6.5,"published":"2025-11-20T15:30:23.000Z","modified":"2025-11-21T18:44:00.137Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"phppgadmin/phppgadmin","sources":[{"name":"OSV · GHSA-927w-vq5c-8gc3","url":"https://osv.dev/vulnerability/GHSA-927w-vq5c-8gc3"}],"ranges":[{"events":[{"introduced":"0"},{"last_affected":"7.13.0"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":[]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-60797","https://github.com/phppgadmin/phppgadmin","https://github.com/phppgadmin/phppgadmin/blob/master/dataexport.php#L118","https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60797.md"],"sources":[{"name":"OSV","id":"GHSA-927w-vq5c-8gc3","modified":"2025-11-21T18:44:00.137020Z","url":"https://osv.dev/vulnerability/GHSA-927w-vq5c-8gc3"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T03:25:32.145Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}