CVE-2020-10803 phpMyAdmin SQL injection vulnerability
An attacker can inject malicious scripts via crafted database entries that execute when viewed in phpMyAdmin, potentially leading to session hijacking or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-10803?
CVE-2020-10803 is a medium-severity cross-site scripting vulnerability in Debian Debian Linux, published on 22 Mar 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.
Which versions are affected by CVE-2020-10803?
5 open source packages ship an affected version, including phpmyadmin/phpmyadmin and phpmyadmin. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
phpmyadmin/phpmyadmin Packagist | From 3.4 | 4.9.5 |
phpmyadmin/phpmyadmin Packagist | From 3.4 | 4.9.5 |
phpmyadmin/phpmyadmin Packagist | From 5.0.0 | 5.0.2 |
phpmyadmin/phpmyadmin Packagist | From 5.0.0 | 5.0.2 |
phpmyadmin Bitnami | From 4.0.0 | 4.9.5, 5.0.2 |
Products include Debian Debian Linux, Fedoraproject Fedora, Opensuse Backports Sle, Opensuse Leap, Phpmyadmin Phpmyadmin, Suse Package Hub.
How do I fix CVE-2020-10803?
Upgrade phpmyadmin/phpmyadmin to a fixed version for your release line: 4.9.5 or 5.0.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-10803 being exploited?
There is no known exploitation of CVE-2020-10803 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-phpmyadmin-2020-10803, DEBIAN-CVE-2020-10803, GHSA-fcww-8wvc-38q9, UBUNTU-CVE-2020-10803.