-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a classic SQL injection in dataexport.php. The script takes a user-supplied SQL query from the $_REQUEST['query'] parameter and executes it directly on the database without any form of sanitization or parameterization. The vulnerable line of code is $rs = $data->conn->Execute($_REQUEST['query']);. An attacker can provide a malicious SQL query in the query parameter to be executed by the database, leading to potential data exfiltration, modification, or deletion. The vulnerable code is not within a specific function but in the global scope of the dataexport.php script, which acts as the entry point for this functionality. Therefore, any runtime profile would show execution within dataexport.php itself when the vulnerability is triggered.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phppgadmin/phppgadmin | composer | <= 7.13.0 |