SQL Injection Affecting phpmyadmin/phpmyadmin package, versions >=4.0.0, <4.9.5 >=5.0.0, <5.0.2
Snyk CVSS
Attack Complexity
High
User Interaction
Required
Threat Intelligence
EPSS
0.23% (61st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-PHPMYADMINPHPMYADMIN-560906
- published 22 Mar 2020
- disclosed 20 Mar 2020
- credit Unknown
Introduced: 20 Mar 2020
CVE-2020-10802 Open this link in a new tabHow to fix?
Upgrade phpmyadmin/phpmyadmin to version 4.9.5, 5.0.2 or higher.
Overview
phpmyadmin/phpmyadmin is a web interface for MySQL and MariaDB.
Affected versions of this package are vulnerable to SQL Injection. Certain parameters were not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.