CVE-2019-18622: SQL injection in phpMyAdmin
Summary
CVE-2019-18622: SQL injection in phpMyAdmin. Affects phpmyadmin/phpmyadmin versions < 4.9.2. Fixed in 4.9.2. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2019-18622 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database operations such as creating, modifying, and deleting tables, executing SQL queries, and managing user permissions. This vulnerability affects versions of phpMyAdmin before 4.9.2.
Vulnerability Detail
The vulnerability identified as CVE-2019-18622 is a SQL injection vulnerability in phpMyAdmin's designer feature. An attacker can exploit this vulnerability by crafting a malicious database or table name, which can then be used to execute arbitrary SQL queries. This can lead to unauthorized access, data manipulation, or even complete compromise of the underlying database server. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
4.9.2
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:4.9.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the designer feature in phpMyAdmin. This can be done by modifying the configuration file or by using access control mechanisms to restrict access to the designer functionality.
Conclusion
In conclusion, phpMyAdmin versions before 4.9.2 are vulnerable to a critical SQL injection vulnerability. Users are advised to upgrade to the latest version or apply the provided workaround to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases. It provides a web-based interface for performing various database operations.
The designer feature in phpMyAdmin allows users to visually design and modify the structure of their database tables.
The SQL injection vulnerability in phpMyAdmin can be exploited by crafting a malicious database or table name, which is then used to execute arbitrary SQL queries.
This vulnerability can lead to unauthorized access, data manipulation, or even complete compromise of the underlying database server.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
