CVE-2025-60799

Executive Summary

CVE-2025-60799 is an incorrect access control vulnerability in phpPgAdmin version 7.13.0 and earlier. The flaw resides in sql.php at lines 68-76, where the application accepts user-controlled parameters (subject, server, database, queryid) without proper validation or access control checks. This allows an unauthenticated attacker to manipulate session variables, specifically $_SESSION['sqlquery'], enabling session poisoning, stored cross-site scripting (XSS), or unauthorized access to sensitive session data. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the potential for session manipulation and data exposure. No official patch is currently available.

Supply Chain & Package Security

phpPgAdmin is a PHP-based web application for PostgreSQL administration. It is typically deployed as a standalone package or via package managers like apt or yum. The vulnerability affects the core application logic in sql.php, not a third-party library. Users should monitor the official phpPgAdmin repository for patch releases and consider applying virtual patching via a Web Application Firewall (WAF) until an official fix is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited session data exposure.
• Integrity (I): Low (L) – Session data can be poisoned.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS base score is 5.3, the lack of authentication and potential for session poisoning elevates the risk in multi-tenant or shared hosting environments.

Deep Dive & Mechanics

The vulnerability is in sql.php lines 68-76. The code directly assigns user-supplied GET/POST parameters to session variables without validation:

// Vulnerable code in sql.php (lines 68-76)
if (isset($_REQUEST['subject'])) {
    $_SESSION['sqlquery'][$_REQUEST['subject']] = array(
        'server' => $_REQUEST['server'],
        'database' => $_REQUEST['database'],
        'queryid' => $_REQUEST['queryid']
    );
}

An attacker can craft a request like:

http://target/phpPgAdmin/sql.php?subject=malicious&server=1&database=test&queryid=SELECT+1

This stores arbitrary data in $_SESSION['sqlquery']. If the application later renders this session data without sanitization, it can lead to stored XSS. Additionally, manipulating queryid can cause the application to execute unintended SQL queries, leading to data leakage or further exploitation.

Vulnerable vs. Patched Code

Vulnerable Code (phpPgAdmin <= 7.13.0):

// sql.php lines 68-76
if (isset($_REQUEST['subject'])) {
    $_SESSION['sqlquery'][$_REQUEST['subject']] = array(
        'server' => $_REQUEST['server'],
        'database' => $_REQUEST['database'],
        'queryid' => $_REQUEST['queryid']
    );
}

Patched Code (Hypothetical Fix):

// Patched version
if (isset($_REQUEST['subject']) && isset($_SESSION['valid_token'])) {
    $subject = filter_var($_REQUEST['subject'], FILTER_SANITIZE_STRING);
    $server = filter_var($_REQUEST['server'], FILTER_SANITIZE_NUMBER_INT);
    $database = filter_var($_REQUEST['database'], FILTER_SANITIZE_STRING);
    $queryid = filter_var($_REQUEST['queryid'], FILTER_SANITIZE_STRING);
    $_SESSION['sqlquery'][$subject] = array(
        'server' => $server,
        'database' => $database,
        'queryid' => $queryid
    );
}

The fix should include:

• Authentication check (e.g., session token validation).
• Input sanitization and validation.
• Restriction of allowed values for subject, server, database, and queryid.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy phpPgAdmin 7.13.0 on a local server (e.g., using Docker: docker run -d -p 8080:80 phpmyadmin/phpmyadmin – note: use phpPgAdmin image if available).
2. Ensure the application is accessible without authentication (default configuration may allow public access).

Exploitation Steps:

1. Send a crafted request to poison the session:

   curl -c cookies.txt -b cookies.txt "http://target/phpPgAdmin/sql.php?subject=evil&server=1&database=test&queryid=<script>alert('XSS')</script>"
   

2. Trigger the stored XSS by accessing a page that renders the session data (e.g., the main query interface).
3. For session poisoning, manipulate queryid to inject malicious SQL that will be executed when the admin views the query history.

Blue Team

Detection:

• Monitor web server logs for requests to sql.php with unexpected parameters (e.g., subject, server, database, queryid).
• Look for anomalous session activity, such as sudden changes in session variables.
• Use WAF rules to block requests containing suspicious patterns in these parameters.

Mitigation:

• Apply virtual patching via WAF to block requests to sql.php with subject parameter.
• Restrict access to sql.php to authenticated users only via server configuration (e.g., .htaccess).
• Monitor for official patches and apply immediately.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /phpPgAdmin/sql.php with parameters subject, server, database, queryid.
  • Unusual session IDs or session data containing script tags or SQL keywords.
• File IOCs:
  • Modified session files on the server (e.g., /tmp/sess_*) containing unexpected data.
• Log IOCs:
  • Web server logs showing repeated requests to sql.php from the same IP.
  • Application logs indicating session variable manipulation.

Detection Engineering

YARA Rule

rule CVE_2025_60799_phpPgAdmin_Session_Poisoning {
    meta:
        description = "Detects exploitation attempts of CVE-2025-60799 in phpPgAdmin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-60799"
    strings:
        $s1 = "sql.php" nocase
        $s2 = "subject=" nocase
        $s3 = "server=" nocase
        $s4 = "database=" nocase
        $s5 = "queryid=" nocase
    condition:
        all of ($s*) and #s1 > 0
}

Sigma Rule

title: CVE-2025-60799 phpPgAdmin Session Poisoning Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting phpPgAdmin sql.php with session manipulation parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'sql.php'
            - 'subject='
            - 'server='
            - 'database='
            - 'queryid='
    condition: selection
falsepositives:
    - Legitimate admin usage (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-60799 phpPgAdmin Session Poisoning Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/phpPgAdmin/sql.php"; http_uri; content:"subject="; http_uri; content:"server="; http_uri; content:"database="; http_uri; content:"queryid="; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: Deploy WAF rules to block requests to sql.php containing the subject parameter.
2. Access Control: Restrict access to sql.php to authenticated users only via server configuration (e.g., .htaccess or Nginx location block).
3. Session Hardening: Implement session validation and regenerate session IDs after login.

Long-Term Fix:

• Apply the official patch once released by the phpPgAdmin maintainers.
• Upgrade to a patched version (currently none available).
• Consider migrating to an alternative PostgreSQL administration tool if no patch is forthcoming.

Monitoring:

• Enable detailed logging for sql.php requests.
• Set up alerts for anomalous session activity.

Valters IT