CVE-2020-22452: SQL Injection vulnerability in phpmyadmin/phpmyadmin
Summary
CVE-2020-22452: phpmyadmin contains SQL Injection vulnerability. Affects phpmyadmin/phpmyadmin versions >= 5.0.0, < 5.0.2. Fixed in 5.0.2. How to fix ↓
Also tracked for
- phpmyadmin · Bitnami
- phpmyadmin · Debian:11
The same CVE-2020-22452 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool written in PHP for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks such as creating, modifying, and deleting databases, tables, and records. The vulnerability identified as CVE-2020-22452 affects phpMyAdmin version 5.x before 5.0.2. This vulnerability specifically targets the 'getTableCreationQuery' function in 'CreateAddField.php' and can be exploited through the 'tbl_storage_engine' or 'tbl_collation' parameters in 'tbl_create.php'.
Vulnerability Detail
The SQL Injection vulnerability in phpMyAdmin allows an attacker to inject malicious SQL code into the 'tbl_storage_engine' or 'tbl_collation' parameters, which are used in the 'getTableCreationQuery' function. By exploiting this vulnerability, an attacker can execute arbitrary SQL queries, potentially gaining unauthorized access to the database, modifying data, or even executing remote code. This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
5.0.2
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:5.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization techniques to prevent the injection of malicious SQL code. It is recommended to thoroughly validate and sanitize user input before using it in SQL queries. Additionally, implementing parameterized queries or prepared statements can help prevent SQL Injection attacks by separating the SQL code from the user input.
Conclusion
The SQL Injection vulnerability in phpMyAdmin poses a significant risk to the security of MySQL databases. It is crucial for users to upgrade their phpMyAdmin installation to version 5.0.2 or later to mitigate this vulnerability. Implementing input validation, sanitization techniques, and using parameterized queries can also help prevent SQL Injection attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases through a web-based interface. It provides a convenient way to perform various database management tasks.
SQL Injection is a type of security vulnerability that allows an attacker to manipulate SQL queries by injecting malicious code. This can lead to unauthorized access, data manipulation, or even remote code execution.
The SQL Injection vulnerability in phpMyAdmin allows attackers to execute arbitrary SQL queries, potentially gaining unauthorized access to the database, modifying data, or executing remote code.
This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8.
To fix this vulnerability, users should upgrade their phpMyAdmin installation to version 5.0.2 or later. The phpMyAdmin development team has released a patch that addresses this issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
