SQL Injection Vulnerability in phpMyAdmin: CVE-2020-5504
Summary
CVE-2020-5504: In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. Affects phpmyadmin across 2 version ranges.
< 4:4.9.4+dfsg1-1
>= 6da64cc3b2ba4439574f914f51e161645375be96, < b732639282104efbc42b3bc040e532649d93a1fe
Fixed in 4:4.9.4+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely-used open-source tool for managing MySQL databases through a web interface. It allows users to perform various database operations such as creating, modifying, and deleting databases and tables. The tool is popular among developers and database administrators for its ease of use and rich feature set. However, certain versions of phpMyAdmin are vulnerable to SQL injection attacks, which can compromise the security of the database.
Vulnerability Detail
CVE-2020-5504 is an SQL injection vulnerability found in phpMyAdmin versions prior to 4.9.4 and 5.0.1. This vulnerability arises from improper handling of user input on the user accounts page, allowing a malicious user to inject arbitrary SQL code in place of their username. An attacker must possess a valid MySQL account to exploit this vulnerability, potentially leading to unauthorized access to sensitive data, data manipulation, or even complete database compromise. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
4:4.9.4+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the phpMyAdmin interface by implementing IP whitelisting or using firewall rules to limit access to trusted IP addresses only. This does not eliminate the vulnerability but can reduce the risk of exploitation.
Conclusion
CVE-2020-5504 is a significant SQL injection vulnerability in phpMyAdmin that can lead to severe security risks if not addressed. Users are strongly advised to upgrade to the latest versions to mitigate potential threats. Additionally, implementing access controls can provide a temporary safeguard until an upgrade can be performed.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2020-5504 is a SQL injection vulnerability in phpMyAdmin that allows attackers to inject malicious SQL code through the user accounts page.
phpMyAdmin versions prior to 4.9.4 and 5.0.1 are vulnerable to this SQL injection issue.
You can check your phpMyAdmin version in the interface or by looking at the version number in the installation directory. If it is below 4.9.4 or 5.0.1, it is vulnerable.
If an immediate upgrade is not possible, consider implementing access restrictions to the phpMyAdmin interface as a temporary measure.
More information can be found on the official CVE website or through security advisories related to phpMyAdmin.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
