pgAdmin < 9.16 Multiple SQL Injections

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(322420);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/02");

  script_cve_id("CVE-2026-12044", "CVE-2026-12050");

  script_name(english:"pgAdmin < 9.16 Multiple SQL Injections");

  script_set_attribute(attribute:"synopsis", value:
"The pgAdmin instance installed on the remote host is affected by multiple SQL injection vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of pgAdmin installed on the remote host is prior to 9.16. It is, therefore, affected by
multiple SQL injection vulnerabilities:

  - Multiple SQL template sites across domain, domain-constraint, foreign-table, language,
    event-trigger, and view dialogs render user-supplied description/comment text inside a Jinja
    pattern via string interpolation instead of the qtLiteral escape filter. An authenticated user
    can break out of the string literal and execute arbitrary SQL as the connected database role.
    (CVE-2026-12044)

  - The restore_point endpoint passes the user-supplied restore-point name directly into a SQL
    query via str.format() instead of using a bound parameter. An authenticated user can inject
    arbitrary SQL that runs as the connected database role. (CVE-2026-12050)

Note that Nessus has not tested for these issues but has instead relied only on the application's
self-reported version number.");
  # https://github.com/pgadmin-org/pgadmin4/blob/REL-9_16/docs/en_US/release_notes_9_16.rst
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?58802d4b");
  script_set_attribute(attribute:"see_also", value:"https://github.com/pgadmin-org/pgadmin4/issues/10078");
  script_set_attribute(attribute:"see_also", value:"https://github.com/pgadmin-org/pgadmin4/issues/10026");
  script_set_attribute(attribute:"solution", value:
"Upgrade pgAdmin to version 9.16 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-12050");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-12044");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:postgresql:pgadmin_4");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("postgresql_pgadmin4_macos_installed.nbin", "postgresql_pgadmin4_win_installed.nbin");
  script_require_keys("installed_sw/PostgreSQL pgAdmin4");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'PostgreSQL pgAdmin4', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '1.0', 'fixed_version': '9.16'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);