CVE-2020-26934: phpMyAdmin XSS Vulnerability
Summary
CVE-2020-26934: phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link. Affects phpmyadmin across 2 version ranges.
>= 4.9.0, < 4.9.6
>= 5.0.0, < 5.0.3
Fixed in 4.9.6 or 5.0.3, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin/phpmyadmin · Packagist
- phpmyadmin · Debian:11
The same CVE-2020-26934 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks, such as creating tables, executing queries, and managing user permissions. This vulnerability affects phpMyAdmin versions before 4.9.6 and 5.x before 5.0.3. The transformation feature in phpMyAdmin can be exploited through a crafted link, leading to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in phpMyAdmin allows an attacker to inject malicious code into the application through a specially crafted link. When a user clicks on the link, the injected code is executed in the context of the user's browser, potentially allowing the attacker to steal sensitive information, perform actions on behalf of the user, or manipulate the application's functionality. This vulnerability has a medium severity rating and can be exploited remotely without authentication.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.9.0, < 4.9.64.9.6 -
>= 5.0.0, < 5.0.35.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the transformation feature in phpMyAdmin. This can be done by modifying the configuration file or using the phpMyAdmin interface to disable the feature. However, disabling the transformation feature may limit certain functionalities of phpMyAdmin, so upgrading to the patched version is still the recommended solution.
Conclusion
The XSS vulnerability in phpMyAdmin can be mitigated by upgrading to the latest patched version or by temporarily disabling the transformation feature. It is important to promptly address this vulnerability to ensure the security of phpMyAdmin instances. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
Versions of phpMyAdmin before 4.9.6 and 5.x before 5.0.3 are affected by this XSS vulnerability.
An attacker can exploit this vulnerability by crafting a malicious link and tricking a user into clicking on it. When the user clicks on the link, the attacker's injected code is executed in the user's browser.
This vulnerability can allow an attacker to steal sensitive information, perform actions on behalf of the user, or manipulate the functionality of the phpMyAdmin application.
Yes, a temporary workaround is to disable the transformation feature in phpMyAdmin. However, this may limit certain functionalities of the application.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
