CVE-2019-11768: phpMyAdmin SQL injection in Designer feature
An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature.
Other sources
phpMyAdmin SQL injection in Designer feature
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpmyadmin/phpmyadminto a version that resolves this vulnerability.Fixed in 4.9.0.1 - Upgrade
Upgrade
alpine/phpmyadminto a version that resolves this vulnerability.Fixed in 4.9.0.1-r0 - Upgrade
Upgrade
ubuntu/phpmyadminto a version that resolves this vulnerability.Fixed in 4:4.5.4.1-2ubuntu2.1+esm3 - Upgrade
Upgrade
ubuntu/phpmyadminto a version that resolves this vulnerability.Fixed in 4:4.6.6-5ubuntu0.5
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-11768.
What is the severity of CVE-2019-11768?
The severity of CVE-2019-11768 is critical, with a severity value of 9.8.
What is the affected software for CVE-2019-11768?
The affected software for CVE-2019-11768 is phpMyAdmin before version 4.9.0.1.
What is the potential impact of this vulnerability?
This vulnerability can be used to trigger an SQL injection attack through the designer feature in phpMyAdmin.
How can I fix CVE-2019-11768?
To fix CVE-2019-11768, update phpMyAdmin to version 4.9.0.1 or later.