CVE-2020-26935: phpMyAdmin SQL injection vulnerability
Summary
CVE-2020-26935: phpMyAdmin SQL injection vulnerability. Affects phpmyadmin/phpmyadmin across 2 version ranges.
>= 4.9.0, < 4.9.6
>= 5.0.0, < 5.0.3
Fixed in 4.9.6 or 5.0.3, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Bitnami
- phpmyadmin · Debian:11
The same CVE-2020-26935 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source administration tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks such as creating, modifying, and deleting databases, tables, and records. The vulnerability identified as CVE-2020-26935 affects phpMyAdmin versions before 4.9.6 and 5.x before 5.0.3. This vulnerability allows an attacker to inject malicious SQL statements into the search feature of phpMyAdmin, potentially leading to unauthorized access, data manipulation, or other malicious activities.
Vulnerability Detail
The SQL injection vulnerability in phpMyAdmin's SearchController allows an attacker to manipulate SQL statements used in the search feature. By injecting malicious SQL code, an attacker can bypass security measures and perform unauthorized actions on the database. This can include extracting sensitive data, modifying or deleting data, or even executing arbitrary commands on the underlying server. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.9.0, < 4.9.64.9.6composer require phpmyadmin/phpmyadmin:4.9.6 -
>= 5.0.0, < 5.0.35.0.3composer require phpmyadmin/phpmyadmin:5.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not possible, a temporary workaround is to disable the search feature in phpMyAdmin. By disabling the search functionality, the vulnerability can be mitigated until a proper upgrade can be performed. To disable the search feature, users can modify the configuration file of phpMyAdmin and set the 'EnableSearch' option to 'false'. This will prevent any SQL injection attempts through the search functionality.
Conclusion
The SQL injection vulnerability in phpMyAdmin poses a significant risk to the security of MySQL databases. It is crucial for users to upgrade their installations to the patched versions or apply the temporary workaround to mitigate the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source administration tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
Versions of phpMyAdmin before 4.9.6 (for 4.x) and before 5.0.3 (for 5.x) are affected by this SQL injection vulnerability.
This vulnerability allows an attacker to inject malicious SQL statements into the search feature of phpMyAdmin, potentially leading to unauthorized access, data manipulation, or other malicious activities.
To fix this vulnerability, users should upgrade their phpMyAdmin installations to version 4.9.6 or later (for 4.x) or version 5.0.3 or later (for 5.x).
Yes, a temporary workaround is to disable the search feature in phpMyAdmin by modifying the configuration file and setting the 'EnableSearch' option to 'false'.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
