In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade phpmyadmin | Aug 22, 2024 | Jan 9, 2020 |
| Debian | — | Upgrade phpmyadmin | Jan 13, 2020 | Jan 9, 2020 |
| Freebsd | — | Upgrade phpMyAdmin5Upgrade phpMyAdmin-php73Upgrade phpMyAdmin-php74Upgrade phpmyadminUpgrade phpMyAdmin5-php72Upgrade phpMyAdmin-php72Upgrade phpMyAdmin5-php73Upgrade phpMyAdmin5-php74 | Jan 12, 2020 | Jan 11, 2020 |
| Phpmyadmin | — | Upgrade phpMyAdmin to the latest version | Jan 27, 2020 | Jan 9, 2020 |
| Suse | — | Upgrade phpmyadmin | Jan 16, 2020 | Jan 9, 2020 |
| Ubuntu | — | Upgrade phpmyadmin (Ubuntu Pro)Upgrade phpmyadmin | Nov 20, 2020 | Jan 9, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub