CVE-2020-10802
Fixed in a distro release EPSS 2%
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.
Products: phpmyadmin, debian_linux, fedoraproject fedora, opensuse backports_sle, opensuse leap, suse package_hub
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | phpmyadmin/phpmyadmin | 4.9.5 |
| Packagist | phpmyadmin/phpmyadmin | 5.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | phpmyadmin | 4:4.9.5+dfsg1-1 |
| Debian 13 | phpmyadmin | 4:4.9.5+dfsg1-1 |
| Debian 14 | phpmyadmin | 4:4.9.5+dfsg1-1 |
| Debian 8 | phpmyadmin | 4:4.2.12-2+deb8u9 |
| SUSE Package Hub 12 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| SUSE Package Hub 12 | phpMyAdmin | 4.9.5-43.1 |
| SUSE Package Hub 15 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| SUSE Package Hub 15 SP1 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| SUSE Package Hub 15 SP1 | phpMyAdmin | 4.9.5-bp151.3.15.1 |
| Ubuntu 18.04 LTS | phpmyadmin | 4:4.6.6-5ubuntu0.5 |
| Ubuntu Pro 14.04 LTS | phpmyadmin | no fix |
| Ubuntu Pro 16.04 LTS | phpmyadmin | no fix |
| openSUSE Leap 15.1 | phpMyAdmin | 4.9.5-43.1 |
| openSUSE Leap 15.1 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| openSUSE Tumbleweed | phpMyAdmin | 5.1.1-1.2 |