Headline
CVE-2020-26935: Security - PMASA-2020-6
An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
Announcement-ID: PMASA-2020-6
Date: 2020-10-10
Summary
SQL injection vulnerability in SearchController
Description
An SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
Severity
We consider this flaw to be of moderate severity.
Affected Versions
phpMyAdmin 4.9.x releases prior to 4.9.6 and the 5.0.x releases prior to 5.0.3 are affected.
Solution
Upgrade to phpMyAdmin 4.9.6 or 5.0.3 or newer or apply patch listed below.
References
Thanks to André Sá from the SCA AppSec group at Checkmarx for reporting this vulnerability.
Assigned CVE ids: CVE-2020-26935
CWE ids: CWE-661
Patches
The following commits have been made to fix this issue:
- d09ab9bc9d634ad08b866d42bb8c4109869d38d2
More information
For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.