CVE-2019-18622: SQL injection in phpMyAdmin
An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpmyadmin/phpmyadminto a version that resolves this vulnerability.Fixed in 4.9.2 - Upgrade
Upgrade
alpine/phpmyadminto a version that resolves this vulnerability.Fixed in 4.9.2-r0
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2019-18622.
What is the severity of CVE-2019-18622?
The severity of CVE-2019-18622 is critical.
What is the affected software for CVE-2019-18622?
The affected software for CVE-2019-18622 includes phpMyAdmin before version 4.9.2, openSUSE Backports SLE 15.0 and 15.0-sp1, Fedoraproject Fedora 30 and 31, and openSUSE Leap 15.0 and 15.1.
How can a SQL injection attack be triggered in phpMyAdmin?
A SQL injection attack can be triggered in phpMyAdmin through the designer feature by using a crafted database/table name.
Are there any references related to CVE-2019-18622?
Yes, you can find the references related to CVE-2019-18622 at the following links: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html, http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html, and https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BA4DGF7KTQS6WA2DRNJSW66L43WB7LRV/