CVE-2020-10803: phpMyAdmin SQL injection vulnerability
Summary
CVE-2020-10803: phpMyAdmin SQL injection vulnerability. Affects phpmyadmin/phpmyadmin across 2 version ranges.
>= 3.4, < 4.9.5
>= 5.0.0, < 5.0.2
Fixed in 4.9.5 or 5.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Bitnami
- phpmyadmin · Debian:11
The same CVE-2020-10803 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks such as creating, modifying, and deleting databases, tables, and queries. This vulnerability affects versions 4.x before 4.9.5 and 5.x before 5.0.2 of phpMyAdmin. The vulnerability allows an attacker to execute SQL injection attacks through the retrieval and display of results in certain parts of the application, specifically in the 'tbl_get_field.php' and 'libraries/classes/Display/Results.php' files. To exploit this vulnerability, the attacker needs to be able to insert crafted data into specific database tables, which can then trigger a cross-site scripting (XSS) attack when the data is retrieved and displayed, for example, through the Browse tab.
Vulnerability Detail
The SQL injection vulnerability in phpMyAdmin allows an attacker to inject malicious code into certain database tables, which can then be used to trigger a cross-site scripting (XSS) attack. This can lead to various security issues, including the theft of sensitive information, session hijacking, and the execution of arbitrary code on the affected system. The vulnerability requires the attacker to have the ability to insert crafted data into the database tables, which may require some level of access to the application or the underlying database. The impact of this vulnerability can be mitigated by applying the recommended fixes or workarounds.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.4, < 4.9.54.9.5composer require phpmyadmin/phpmyadmin:4.9.5 -
>= 5.0.0, < 5.0.25.0.2composer require phpmyadmin/phpmyadmin:5.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the affected functionality in phpMyAdmin. This can be done by modifying the configuration or access controls to restrict access to the vulnerable parts of the application. It is important to note that this is only a temporary solution and upgrading to the latest version is still recommended to fully address the vulnerability.
Conclusion
The SQL injection vulnerability in phpMyAdmin can lead to serious security issues if exploited. It is crucial to upgrade to the latest version of phpMyAdmin to ensure the security of your database management system. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases through a web-based interface. It provides a convenient way to perform various database management tasks.
Versions 4.x before 4.9.5 and 5.x before 5.0.2 of phpMyAdmin are affected by this vulnerability.
This vulnerability can allow an attacker to execute SQL injection attacks and trigger cross-site scripting (XSS) attacks, potentially leading to the theft of sensitive information, session hijacking, and arbitrary code execution.
To fix this vulnerability, it is recommended to upgrade to phpMyAdmin version 4.9.5 or later for versions 4.x, and version 5.0.2 or later for versions 5.x.
A temporary workaround is to disable the affected functionality in phpMyAdmin by modifying the configuration or access controls. However, upgrading to the latest version is still recommended.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
