Listen to this Post
How the CVE Works:
The vulnerability exists in the `sql.php` file of phpPgAdmin. Between lines 68 and 76, the code directly accepts user-supplied parameters ‘subject’, ‘server’, ‘database’, and ‘queryid’ without performing adequate access control checks. An attacker can send a crafted HTTP request manipulating these parameters. The application then uses these untrusted values to construct and store a corresponding SQL query string directly into the `$_SESSION[‘sqlquery’]` variable. This incorrect access control allows for session poisoning, where malicious data is stored within the user’s session. This poisoned session can subsequently lead to other attacks, such as Stored Cross-Site Scripting (XSS) if the stored SQL query is later rendered on a page without proper output encoding, or unauthorized access to database information.
DailyCVE Form:
Platform: phppgadmin
Version: <=7.13.0
Vulnerability: Session Poisoning
Severity: Moderate
date: 2025-11-20
Prediction: Patch 2025-12-04
What Undercode Say:
grep -n "68-76" sql.php curl -X POST -d "subject=crafted&server=malicious" http://target/sql.php
// Code snippet from vulnerable lines ~68-76 in sql.php $_SESSION['sqlquery'][$_REQUEST['subject']][$_REQUEST['server']][$_REQUEST['database']][$_REQUEST['queryid']] = $query;
How Exploit:
1. Attacker crafts malicious HTTP request.
2. Manipulates ‘subject’, ‘server’ parameters.
3. Injects payload into user session.
4. Stored XSS triggers on page load.
Protection from this CVE:
Update phpPgAdmin.
Input validation.
Sanitize session data.
Implement access controls.
Impact:
Session Poisoning.
Stored XSS.
Unauthorized data access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
