pgAdmin < 9.10 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(275843);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/12");

  script_cve_id(
    "CVE-2025-12762",
    "CVE-2025-12763",
    "CVE-2025-12764",
    "CVE-2025-12765"
  );
  script_xref(name:"IAVB", value:"2025-B-0190-S");

  script_name(english:"pgAdmin < 9.10 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The pgAdmin instance installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of pgAdmin installed on the remote host is prior to 9.10. It is, therefore, affected by the
following vulnerabilities:

  - pgAdmin versions prior to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when 
    running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers 
    to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the 
    integrity and security of the database management system and underlying data. (CVE-2025-12762)

  - pgAdmin versions prior to 9.10 is affected by an LDAP injection vulnerability in the LDAP authentication flow that 
    allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and 
    the client to process an unusual amount of data DOS. (CVE-2025-12764)

  - pgAdmin versions prior to 9.10 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing 
    TLS certificate verification. (CVE-2025-12765)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.postgresql.org/about/news/pgadmin-4-v910-released-3173/");
  script_set_attribute(attribute:"solution", value:
"Upgrade pgAdmin to version 9.10 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-12763");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-12762");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:postgresql:pgadmin_4");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("postgresql_pgadmin4_macos_installed.nbin", "postgresql_pgadmin4_win_installed.nbin");
  script_require_ports("installed_sw/PostgreSQL pgAdmin4");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'PostgreSQL pgAdmin4', 'type': 'app'},
      'requires': [ {'scope': 'target', 'match_one': {'os': ['windows', 'macos'] } } ],
      'check_algorithm': 'default',
      'constraints': [
        {
          'fixed_version': '9.10'
        }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);