CVE-2020-26935: SQL Injection Vulnerability in phpMyAdmin
Summary
CVE-2020-26935: An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. Affects phpmyadmin across 2 version ranges.
>= 4.9.0, < 4.9.6
>= 5.0.0, < 5.0.3
Fixed in 4.9.6 or 5.0.3, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin/phpmyadmin · Packagist
- phpmyadmin · Debian:11
The same CVE-2020-26935 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source administration tool for managing MySQL and MariaDB databases. It provides a web-based interface for performing various database management tasks such as creating, modifying, and deleting databases, tables, and queries. This vulnerability affects versions before 4.9.6 and 5.x before 5.0.3 of phpMyAdmin.
Vulnerability Detail
The vulnerability discovered in phpMyAdmin is a SQL injection flaw that exists in the SearchController. It occurs due to improper processing of SQL statements in the search feature. An attacker can exploit this vulnerability by injecting malicious SQL code into a query, potentially leading to unauthorized access, data manipulation, or other malicious activities. This vulnerability is considered critical, as it can have severe consequences for the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.9.0, < 4.9.64.9.6 -
>= 5.0.0, < 5.0.35.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading phpMyAdmin is not immediately feasible, a temporary workaround is to disable the search feature in the application. By disabling the search functionality, the potential attack vector for this vulnerability can be eliminated. However, this workaround may impact the usability of the application for users who rely on the search feature.
Conclusion
The SQL injection vulnerability in phpMyAdmin poses a significant risk to the security of database management systems. It is crucial to upgrade to the patched versions or apply the provided workaround to mitigate the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is an open-source administration tool for managing MySQL and MariaDB databases. It provides a web-based interface for performing various database management tasks.
Versions before 4.9.6 and 5.x before 5.0.3 of phpMyAdmin are affected by this SQL injection vulnerability.
This vulnerability allows an attacker to inject malicious SQL code into a query, potentially leading to unauthorized access, data manipulation, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade phpMyAdmin to version 4.9.6 or later (for 4.x branch) or version 5.0.3 or later (for 5.x branch).
Yes, a temporary workaround is to disable the search feature in phpMyAdmin until the application can be upgraded to a patched version.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
