CVE-2025-60799
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
62/100
Published: 2025-11-20
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Network
Low Complexity
No Auth
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Required
S:
Changed
C:
Low
I:
Low
A:
None
Description
phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters ('subject', 'server', 'database', 'queryid') without proper validation or access control checks. Attackers can exploit this to store arbitrary SQL queries in $_SESSION['sqlquery'] by manipulating these parameters, potentially leading to session poisoning, stored cross-site scripting, or unauthorized access to sensitive session data.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| phppgadmin_project | phppgadmin | < 7.13.0 |
References & Advisories (2)
Third Party Advisory
Product