CVE-2025-60799 is a security vulnerability identified in phpPgAdmin, a popular web-based administration tool for PostgreSQL databases. The vulnerability exists in the sql.php script, specifically between lines 68 and 76, where the application improperly handles user-supplied parameters such as 'subject', 'server', 'database', and 'queryid'. These parameters are used to manipulate session variables without adequate validation or access control checks. As a result, an attacker can inject arbitrary SQL queries into the $_SESSION['sqlquery'] variable, effectively poisoning the session. This session poisoning can lead to stored cross-site scripting (XSS) attacks, where malicious scripts are persistently stored and executed in the context of the victim's browser, potentially compromising user credentials or session tokens. Additionally, unauthorized access to sensitive session data can occur, undermining the confidentiality and integrity of the session. The vulnerability does not require prior authentication, increasing its risk profile, and can be exploited by sending crafted HTTP requests to the vulnerable phpPgAdmin instance. Although no public exploits have been reported yet, the flaw poses a significant risk to environments where phpPgAdmin is deployed, especially if accessible over the internet or within poorly segmented networks. The lack of a CVSS score indicates that the vulnerability is newly disclosed and not yet fully assessed, but the technical details suggest a high potential impact on session security and database administration integrity.

For European organizations, this vulnerability could lead to unauthorized access to PostgreSQL database management interfaces, potentially exposing sensitive business data or enabling further compromise of internal systems. Organizations relying on phpPgAdmin for database administration, particularly those with web-accessible instances, face risks of session hijacking, data leakage, and execution of malicious scripts within administrative sessions. This could disrupt database operations, lead to data integrity issues, or facilitate lateral movement by attackers. The impact is heightened in sectors with stringent data protection requirements such as finance, healthcare, and government, where unauthorized data exposure could result in regulatory penalties under GDPR. Additionally, session poisoning and stored XSS could be leveraged to escalate privileges or bypass authentication controls, increasing the threat surface. The absence of known exploits in the wild provides a window for proactive mitigation, but the vulnerability's nature demands urgent attention to prevent exploitation.

1. Restrict access to phpPgAdmin interfaces by limiting exposure to trusted networks or via VPNs to reduce attack surface. 2. Implement strict input validation and sanitization on all parameters accepted by sql.php, especially 'subject', 'server', 'database', and 'queryid', to prevent injection of malicious data into session variables. 3. Monitor and audit web server logs for unusual or suspicious requests targeting sql.php parameters that could indicate exploitation attempts. 4. Employ web application firewalls (WAFs) with custom rules to detect and block attempts to manipulate session variables or inject SQL queries. 5. Enforce secure session management practices, including regenerating session IDs after login and setting appropriate cookie flags (HttpOnly, Secure, SameSite). 6. Apply patches or updates from phpPgAdmin maintainers as soon as they become available. 7. Consider alternative PostgreSQL administration tools with stronger security postures if immediate patching is not feasible. 8. Educate administrators about the risks of exposing phpPgAdmin publicly and encourage the use of multi-factor authentication where possible.