CVE-2020-10802: phpMyAdmin SQL injection vulnerability
Summary
CVE-2020-10802: phpMyAdmin SQL injection vulnerability. Affects phpmyadmin/phpmyadmin across 2 version ranges.
>= 4.9.0, < 4.9.5
>= 5.0.0, < 5.0.2
Fixed in 4.9.5 or 5.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Bitnami
- phpmyadmin · Debian:11
The same CVE-2020-10802 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases through a web interface. It provides users with a convenient way to interact with their databases, perform queries, and manage database structures. However, a SQL injection vulnerability has been discovered in versions 4.x before 4.9.5 and 5.x before 5.0.2 of phpMyAdmin. This vulnerability arises from improper escaping of certain parameters when generating search queries in the TableSearchController.php file. Attackers can exploit this vulnerability by crafting a malicious database or table name and tricking a user into performing search operations on it.
Vulnerability Detail
The SQL injection vulnerability in phpMyAdmin allows attackers to inject malicious SQL code into search queries. By manipulating the database or table name, an attacker can execute arbitrary SQL statements, potentially leading to unauthorized access, data manipulation, or even remote code execution. This vulnerability can be exploited if a user performs certain search operations on the manipulated database or table. The impact of this vulnerability can be severe, as it provides attackers with unauthorized access to the database and the ability to manipulate or extract sensitive data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.9.0, < 4.9.54.9.5composer require phpmyadmin/phpmyadmin:4.9.5 -
>= 5.0.0, < 5.0.25.0.2composer require phpmyadmin/phpmyadmin:5.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can mitigate the risk by avoiding performing search operations on untrusted or suspicious databases or tables. Additionally, it is crucial to ensure that all user input is properly sanitized and escaped to prevent SQL injection attacks.
Conclusion
The phpMyAdmin SQL injection vulnerability (CVE-2020-10802) poses a significant risk to systems running affected versions. It allows attackers to execute arbitrary SQL statements and potentially gain unauthorized access to databases. To mitigate this vulnerability, it is essential to upgrade to phpMyAdmin version 4.9.5 or 5.0.2. Additionally, users should follow best practices for input validation and sanitization to prevent SQL injection attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases through a web interface. It provides users with a convenient way to interact with their databases, perform queries, and manage database structures.
A SQL injection vulnerability occurs when an application does not properly validate or sanitize user input, allowing an attacker to inject malicious SQL code into database queries. This can lead to unauthorized access, data manipulation, or even remote code execution.
An attacker can exploit this vulnerability by crafting a malicious database or table name and tricking a user into performing search operations on it. This allows the attacker to execute arbitrary SQL statements and potentially gain unauthorized access to the database.
The consequences of this vulnerability can be severe. Attackers can gain unauthorized access to the database, manipulate or extract sensitive data, and even execute remote code on the server.
To protect your phpMyAdmin installation, it is crucial to keep it up to date with the latest security patches. Regularly check for updates and apply them promptly. Additionally, ensure that all user input is properly sanitized and escaped to prevent SQL injection attacks.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.