phpPgAdmin SQL Injection Vulnerability in display.php

A SQL injection vulnerability has been identified in phpPgAdmin versions through 7.13.0. The issue arises in display.php, specifically at line 396, where user-controlled input from the $_REQUEST['query'] parameter is passed directly to the browseQuery function without proper sanitization. This vulnerability allows authenticated attackers to inject and execute arbitrary SQL commands, potentially leading to a complete compromise of the database.

Impact

Exploitation of this vulnerability allows for arbitrary SQL command execution, which could lead to unauthorized data access, data manipulation, or a complete compromise of the PostgreSQL database.