Headline
CVE-2020-10804: Security - PMASA-2020-2
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges).
Announcement-ID: PMASA-2020-2
Date: 2020-03-20
Updated: 2020-03-22
Summary
SQL injection with processing username
Description
An SQL injection vulnerability was found in how phpMyAdmin retrieves the current username.
A malicious user with access to the server could create a specially-crafted username and then trick the victim in to performing specific actions with that user account (such as editing its privileges).
This flaw also could generate server errors for users with certain characters who try to change their MySQL passwords.
Severity
Because of the specific steps required to exploit this, we consider this vulnerability to be of moderate severity
Affected Versions
phpMyAdmin 4.9.x releases prior to 4.9.5 and the 5.0.x releases prior to 5.0.2 are affected.
Solution
Upgrade to phpMyAdmin 4.9.5 or 5.0.2 or newer or apply patch listed below.
References
Thanks to hoangn144_VCS and bluebird for reporting these vulnerabilities.
Assigned CVE ids: CVE-2020-10804
CWE ids: CWE-661
Patches
The following commits have been made to fix this issue:
- 89fbcd7c39e6b3979cdb2f64aa4cd5f4db27eaad
- 3258978c38bee8cb4b99f249dffac9c8aaea2d80
More information
For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.