CVE-2019-11768: phpMyAdmin SQL injection in Designer feature
Summary
CVE-2019-11768: phpMyAdmin SQL injection in Designer feature. Affects phpmyadmin/phpmyadmin versions < 4.9.0.1. Fixed in 4.9.0.1. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2019-11768 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks, such as creating, modifying, and deleting databases, tables, and queries. The Designer feature in phpMyAdmin allows users to visually design and manage their database schemas. This vulnerability affects phpMyAdmin versions prior to 4.9.0.1.
Vulnerability Detail
The vulnerability identified as CVE-2019-11768 is an SQL injection vulnerability that exists in the Designer feature of phpMyAdmin. An attacker can exploit this vulnerability by providing a specially crafted database name, which can trigger an SQL injection attack. This can lead to unauthorized access, data manipulation, or even remote code execution on the affected system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
4.9.0.1
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:4.9.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can apply a temporary workaround by disabling the Designer feature in phpMyAdmin. This can be done by modifying the configuration file or by using the phpMyAdmin interface to disable the feature. However, it is important to note that this workaround only mitigates the risk and does not provide a permanent solution. Upgrading to the latest version is still strongly recommended.
Conclusion
In conclusion, the phpMyAdmin SQL injection vulnerability in the Designer feature can be exploited by providing a specially crafted database name. This can lead to unauthorized access, data manipulation, or remote code execution. It is crucial to upgrade to phpMyAdmin version 4.9.0.1 or later to mitigate the risk. If immediate upgrade is not possible, disabling the Designer feature can provide temporary mitigation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
The Designer feature in phpMyAdmin allows users to visually design and manage their database schemas.
An SQL injection vulnerability occurs when an attacker is able to manipulate an SQL query to execute unintended commands or access unauthorized data.
This vulnerability can lead to unauthorized access, data manipulation, or even remote code execution on the affected system.
To fix this vulnerability, it is recommended to upgrade phpMyAdmin to version 4.9.0.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
