SQL Injection Vulnerability in phpMyAdmin: CVE-2020-10802
Summary
CVE-2020-10802: In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/cla... Affects phpmyadmin across 2 version ranges.
< 4:4.9.5+dfsg1-1
>= 6da64cc3b2ba4439574f914f51e161645375be96, < 1651d674d65bdd032071733f57cfff9b496e7d85
Fixed in 4:4.9.5+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely-used open-source tool for managing MySQL databases through a web interface. It allows users to perform various database operations such as creating, modifying, and deleting databases and tables. The tool is popular among developers and database administrators due to its user-friendly interface and extensive features. However, certain versions of phpMyAdmin are vulnerable to SQL injection attacks, which can compromise the security of the database.
Vulnerability Detail
CVE-2020-10802 is a SQL injection vulnerability found in phpMyAdmin versions 4.x before 4.9.5 and 5.x before 5.0.2. The vulnerability arises from improper escaping of certain parameters when generating queries for search actions in the TableSearchController.php file. An attacker can exploit this vulnerability by crafting a malicious database or table name, leading to unauthorized access or manipulation of the database. The potential ramifications include data leakage, data corruption, and unauthorized administrative actions.
How To Fix
Minimum fixed version
4:4.9.5+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the phpMyAdmin interface by implementing IP whitelisting or using strong authentication methods. Additionally, avoid performing search operations on untrusted databases or tables until the software is updated.
Conclusion
CVE-2020-10802 represents a significant security risk for users of phpMyAdmin versions prior to 4.9.5 and 5.0.2. It is crucial for users to update their installations to mitigate the risk of SQL injection attacks. Regular monitoring and updates are essential to maintain the security of database management systems.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2020-10802 is a SQL injection vulnerability in phpMyAdmin that allows attackers to manipulate database queries through improperly escaped parameters.
The vulnerability affects phpMyAdmin versions 4.x before 4.9.5 and 5.x before 5.0.2.
Exploitation of this vulnerability can lead to unauthorized access, data leakage, data corruption, and potential administrative control over the database.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2020-10802 is 8.0, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
