SQL Injection Vulnerability in phpMyAdmin: A Threat to Database Integrity
Summary
CVE-2019-11768: An issue was discovered in phpMyAdmin before 4.9.0.1. Affects phpmyadmin across 2 version ranges.
< 4:4.9.1+dfsg1-2
< c60a750764b8a4b927b15e03640908ef751089d7
Fixed in 4:4.9.1+dfsg1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely used open-source tool for managing MySQL databases through a web interface. It allows users to perform various database operations such as creating, modifying, and deleting databases and tables. Despite its popularity, phpMyAdmin has been found to be vulnerable to SQL injection attacks, particularly through its designer feature, which can be exploited by specially crafted database names.
Vulnerability Detail
The vulnerability, identified as CVE-2019-11768, arises from improper handling of database names within phpMyAdmin prior to version 4.9.0.1. An attacker can exploit this flaw by submitting a specially crafted database name, which can lead to SQL injection. This could allow unauthorized access to sensitive data, manipulation of database contents, and potentially complete control over the database server. The vulnerability has a CVSS score of 9.8, indicating a critical level of severity.
How To Fix
Minimum fixed version
4:4.9.1+dfsg1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider restricting access to phpMyAdmin by implementing firewall rules or using HTTP authentication to limit who can access the tool. Additionally, avoid using database names that could be crafted to exploit this vulnerability.
Conclusion
The SQL injection vulnerability in phpMyAdmin (CVE-2019-11768) poses a significant risk to database integrity. Users are strongly advised to upgrade to the latest version to mitigate this risk. For those unable to upgrade immediately, implementing access restrictions can serve as a temporary workaround. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2019-11768 is a vulnerability in phpMyAdmin that allows for SQL injection attacks through specially crafted database names.
You can check your phpMyAdmin version and compare it with the fixed version (4.9.1+dfsg1-2). Additionally, you can use Vulert's playground to monitor for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, data manipulation, and complete control over the database server.
Yes, you can restrict access to phpMyAdmin and avoid using potentially exploitable database names as a temporary measure.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file. You can check for vulnerabilities in your application without needing to install any software.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
