Critical SQL Injection Vulnerability in phpMyAdmin: CVE-2020-22452
Summary
CVE-2020-22452: SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php. Affects phpmyadmin across 2 version ranges.
< 4:5.0.4+dfsg1-1
>= c124aacc32329f69f3e8189c61c5d82f6d9fcd47, < 9dfedff70b3f604f682ee28471544265dcafe20e
Fixed in 4:5.0.4+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
phpMyAdmin is a widely-used open-source tool for managing MySQL databases through a web interface. It allows users to perform various database operations such as creating, modifying, and deleting databases and tables. The tool is known for its user-friendly interface and extensive feature set, making it a popular choice among developers and database administrators. However, phpMyAdmin versions prior to 5.2.0 are vulnerable to a SQL Injection attack, which can compromise the security of the database and the application.
Vulnerability Detail
The vulnerability, identified as CVE-2020-22452, arises from improper handling of user input in the getTableCreationQuery function within CreateAddField.php. Specifically, the tbl_storage_engine and tbl_collation parameters in tbl_create.php can be manipulated to execute arbitrary SQL commands. This can lead to unauthorized access to sensitive data, data corruption, or even complete control over the database server. The severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a critical risk level.
How To Fix
Minimum fixed version
4:5.0.4+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to restrict access to the phpMyAdmin interface by implementing IP whitelisting or using a web application firewall to filter out malicious requests. Additionally, ensure that database permissions are set to the least privilege necessary for users.
Conclusion
CVE-2020-22452 represents a significant security risk for users of phpMyAdmin versions prior to 5.2.0. It is crucial for users to upgrade to the latest version to protect their databases from potential SQL Injection attacks. Implementing workarounds can provide temporary relief, but upgrading is the most effective solution.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2020-22452 is a critical SQL Injection vulnerability found in phpMyAdmin versions prior to 5.2.0, allowing attackers to execute arbitrary SQL commands.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive data, data corruption, or complete control over the database server.
Yes, you can implement IP whitelisting or use a web application firewall to filter out malicious requests as a temporary measure.
The CVSS score for CVE-2020-22452 is 9.8, indicating a critical risk level.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
