SQL Injection and XSS Vulnerability in phpMyAdmin: CVE-2020-10803
Summary
CVE-2020-10803: In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.ph... Affects phpmyadmin across 2 version ranges.
< 4:4.9.5+dfsg1-1
>= 6da64cc3b2ba4439574f914f51e161645375be96, < 1651d674d65bdd032071733f57cfff9b496e7d85
Fixed in 4:4.9.5+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
phpMyAdmin is a widely-used open-source tool for managing MySQL databases through a web interface. It allows users to perform various database operations such as creating, modifying, and deleting databases and tables. Despite its robust functionality, phpMyAdmin has been susceptible to security vulnerabilities, including SQL injection and cross-site scripting (XSS) attacks, which can compromise the integrity and security of the database.
Vulnerability Detail
CVE-2020-10803 is a SQL injection vulnerability found in phpMyAdmin versions 4.x before 4.9.5 and 5.x before 5.0.2. This vulnerability allows an attacker to inject malicious SQL code into database queries, potentially leading to unauthorized access and manipulation of database contents. The attacker can exploit this vulnerability by inserting crafted data into specific database tables, which, when retrieved through the phpMyAdmin interface, can trigger an XSS attack. This could result in the execution of arbitrary scripts in the context of the user's browser, compromising user data and session integrity.
How To Fix
Minimum fixed version
4:4.9.5+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not possible, consider restricting access to phpMyAdmin by implementing IP whitelisting or using a VPN to limit exposure. Additionally, ensure that database user permissions are tightly controlled to minimize potential damage from exploitation.
Conclusion
CVE-2020-10803 represents a significant security risk for users of phpMyAdmin versions prior to 4.9.5 and 5.0.2. It is crucial for users to upgrade their installations to mitigate the risk of SQL injection and XSS attacks. Implementing additional security measures can also help protect against potential exploitation.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2020-10803 is a vulnerability in phpMyAdmin that allows for SQL injection and XSS attacks, affecting versions prior to 4.9.5 and 5.0.2.
Check the version of your phpMyAdmin installation. If it is below 4.9.5 for the 4.x series or below 5.0.2 for the 5.x series, it is vulnerable.
Exploitation of this vulnerability can lead to unauthorized access to database contents, data manipulation, and execution of malicious scripts in users' browsers.
You can upgrade phpMyAdmin by downloading the latest version from the official website or using package management commands such as 'sudo apt-get install phpmyadmin' on Debian-based systems.
Yes, Vulert can monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json, without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
