SQL Injection Vulnerability in phpMyAdmin: CVE-2019-18622
Summary
CVE-2019-18622: An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature. Affects phpmyadmin across 2 version ranges.
< 4:4.9.2+dfsg1-1
< 4e615cc5e5165de4663bb2510ffaf97bc953e718
Fixed in 4:4.9.2+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely-used open-source tool for managing MySQL databases through a web interface. It allows users to perform various database operations, such as creating, modifying, and deleting databases and tables. The tool is popular among developers and database administrators for its user-friendly interface and extensive features. However, prior to version 4.9.2, phpMyAdmin was susceptible to a SQL injection vulnerability that could be exploited through crafted database or table names.
Vulnerability Detail
CVE-2019-18622 is a SQL injection vulnerability found in phpMyAdmin versions before 4.9.2. This vulnerability arises when a user can manipulate database or table names in a way that triggers an SQL injection attack through the designer feature. If exploited, an attacker could gain unauthorized access to sensitive data, modify or delete database contents, and potentially compromise the entire database system. The vulnerability has a CVSS score of 9.8, indicating a critical level of severity.
How To Fix
Minimum fixed version
4:4.9.2+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider restricting access to phpMyAdmin by implementing IP whitelisting or using a VPN to limit exposure. Additionally, review and sanitize any user inputs related to database and table names to mitigate potential injection risks.
Conclusion
CVE-2019-18622 represents a critical SQL injection vulnerability in phpMyAdmin that can have severe consequences if exploited. Users are urged to upgrade to the latest version to protect their database systems. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2019-18622 is a SQL injection vulnerability in phpMyAdmin that allows attackers to exploit crafted database or table names.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, data modification, or deletion, and potential compromise of the database system.
It is highly recommended to upgrade to phpMyAdmin version 4.9.2 or later to mitigate the risk associated with this vulnerability.
Yes, consider restricting access to phpMyAdmin and sanitizing user inputs related to database and table names as temporary measures.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
