CVE-2019-18622: SQL Injection
An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2019-18622.
What is the severity of CVE-2019-18622?
The severity of CVE-2019-18622 is critical.
What is the affected software for CVE-2019-18622?
The affected software for CVE-2019-18622 includes phpMyAdmin before version 4.9.2, openSUSE Backports SLE 15.0 and 15.0-sp1, Fedoraproject Fedora 30 and 31, and openSUSE Leap 15.0 and 15.1.
How can a SQL injection attack be triggered in phpMyAdmin?
A SQL injection attack can be triggered in phpMyAdmin through the designer feature by using a crafted database/table name.
Are there any references related to CVE-2019-18622?
Yes, you can find the references related to CVE-2019-18622 at the following links: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html, http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html, and https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BA4DGF7KTQS6WA2DRNJSW66L43WB7LRV/