CVE-2020-10804: SQL Injection
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this SQL injection?
The vulnerability ID for this SQL injection is CVE-2020-10804.
What is the severity of CVE-2020-10804?
The severity of CVE-2020-10804 is dependent on the specific use case and configuration, but SQL injections can have a high impact if exploited.
How does the SQL injection vulnerability in phpMyAdmin impact usernames?
The SQL injection vulnerability in phpMyAdmin allows an attacker to manipulate the processing of usernames, potentially gaining unauthorized access or causing data breaches.
What versions of phpMyAdmin are affected by this SQL injection vulnerability?
Versions 4.9.0 to 4.9.5 and 5.0.0 to 5.0.2 of phpMyAdmin are affected by this SQL injection vulnerability.
How can I fix the SQL injection vulnerability in phpMyAdmin?
To fix the SQL injection vulnerability, it is recommended to update phpMyAdmin to a version that includes the security patch provided by the vendor.