CVE-2020-10802 phpMyAdmin SQL injection vulnerability
An attacker can execute arbitrary SQL commands via crafted database or table names during search operations in phpMyAdmin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-10802?
CVE-2020-10802 is a high-severity SQL injection vulnerability in Debian Debian Linux, published on 22 Mar 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.
Weakness: CWE-89
Which versions are affected by CVE-2020-10802?
5 open source packages ship an affected version, including phpmyadmin/phpmyadmin and phpmyadmin. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
phpmyadmin/phpmyadmin Packagist | From 4.9.0 | 4.9.5 |
phpmyadmin/phpmyadmin Packagist | From 4.9.0 | 4.9.5 |
phpmyadmin/phpmyadmin Packagist | From 5.0.0 | 5.0.2 |
phpmyadmin/phpmyadmin Packagist | From 5.0.0 | 5.0.2 |
phpmyadmin Bitnami | From 4.0.0 | 4.9.5, 5.0.2 |
Products include Debian Debian Linux, Fedoraproject Fedora, Opensuse Backports Sle, Opensuse Leap, Phpmyadmin Phpmyadmin, Suse Package Hub.
How do I fix CVE-2020-10802?
Upgrade phpmyadmin/phpmyadmin to a fixed version for your release line: 4.9.5 or 5.0.2.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-10802 being exploited?
There is no known exploitation of CVE-2020-10802 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-phpmyadmin-2020-10802, DEBIAN-CVE-2020-10802, GHSA-f4cr-3xmc-2wpm, UBUNTU-CVE-2020-10802.