CVE-2019-6798: phpMyAdmin SQL injection in Designer feature
Summary
CVE-2019-6798: phpMyAdmin SQL injection in Designer feature. Affects phpmyadmin/phpmyadmin versions < 4.8.5. Fixed in 4.8.5. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2019-6798 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks such as creating, modifying, and deleting databases, tables, and records. The Designer feature in phpMyAdmin allows users to visually design and manage their database schema. However, a vulnerability has been discovered in versions prior to 4.8.5 that can be exploited through the Designer feature.
Vulnerability Detail
The vulnerability, identified as CVE-2019-6798, is a SQL injection vulnerability that can be triggered by a specially crafted username. An attacker can exploit this vulnerability by submitting a malicious username through the Designer feature. This can lead to unauthorized access, data manipulation, or even remote code execution on the underlying database server. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
4.8.5
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:4.8.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can apply a temporary workaround by disabling the Designer feature in phpMyAdmin. This can be done by modifying the configuration file or by using the phpMyAdmin interface to disable the feature. However, it is important to note that disabling the Designer feature may impact the functionality and usability of phpMyAdmin.
Conclusion
In conclusion, phpMyAdmin versions prior to 4.8.5 are vulnerable to a SQL injection attack through the Designer feature. This vulnerability can be mitigated by upgrading to the latest version or by disabling the Designer feature. It is important to take prompt action to protect your database from potential exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
The Designer feature in phpMyAdmin allows users to visually design and manage their database schema.
A SQL injection vulnerability allows an attacker to manipulate SQL queries executed by an application, potentially leading to unauthorized access or data manipulation.
This vulnerability can be exploited to gain unauthorized access, manipulate data, or execute arbitrary code on the underlying database server.
To fix this vulnerability, it is recommended to upgrade phpMyAdmin to version 4.8.5 or later.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
