CVE-2021-47853
CVE-2021-47853 · phpPgAdmin contains a remote command execution vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
phpPgAdmin 7.13.0 contains a remote command execution vulnerability that allows authenticated attackers to execute arbitrary system commands through SQL query manipulation. Attackers can create a custom table, upload a malicious .txt file, and use the COPY FROM PROGRAM command to execute operating system commands with the application's privileges.
CVSS 8.8 · High
- Published
- Updated
Stack: php
Affected products and versions
phppgadmin/phppgadmin Packagist
- Affected ranges
- ECOSYSTEM: ≤ 7.13.0
No fix published
Original sources
- https://nvd.nist.gov/vuln/detail/CVE-2021-47853
- https://github.com/phppgadmin/phppgadmin
- https://github.com/phppgadmin/phppgadmin/releases
- https://www.exploit-db.com/exploits/49736
- https://www.vulncheck.com/advisories/phppgadmin-copy-from-program-command-execution
- https://osv.dev/vulnerability/GHSA-86gh-c8r8-xwhq