CVE-2020-22452: phpmyadmin contains SQL Injection vulnerability
phpmyadmin contains SQL Injection vulnerability
Other sources
SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.0.2 via the tblstorageengine or tblcollation parameters to tblcreate.php.
— GitHub
SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tblstorageengine or tblcollation parameters to tblcreate.php.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpmyadmin/phpmyadminto a version that resolves this vulnerability.Fixed in 5.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2020-22452?
The severity of CVE-2020-22452 is critical with a CVSS score of 9.8.
Which software is affected by CVE-2020-22452?
phpMyAdmin versions between 5.0.0 and 5.2.0 are affected by CVE-2020-22452.
How can I exploit the vulnerability in CVE-2020-22452?
To exploit the vulnerability in CVE-2020-22452, an attacker can use the tbl_storage_engine or tbl_collation parameters in tbl_create.php.
How can I fix CVE-2020-22452?
To fix CVE-2020-22452, it is recommended to upgrade phpMyAdmin to version 5.2.0 or newer.
Where can I find more information about CVE-2020-22452?
More information about CVE-2020-22452 can be found at phpmyadmin.com and the phpMyAdmin GitHub repository.