CVE-2020-10803
Fixed in a distro release EPSS 1%
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.
Products: phpmyadmin, debian_linux, fedoraproject fedora, opensuse backports_sle, opensuse leap, suse package_hub
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | phpmyadmin/phpmyadmin | 4.9.5 |
| Packagist | phpmyadmin/phpmyadmin | 5.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | phpmyadmin | 4:4.9.5+dfsg1-1 |
| Debian 13 | phpmyadmin | 4:4.9.5+dfsg1-1 |
| Debian 14 | phpmyadmin | 4:4.9.5+dfsg1-1 |
| Debian 8 | phpmyadmin | 4:4.2.12-2+deb8u9 |
| SUSE Package Hub 12 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| SUSE Package Hub 12 | phpMyAdmin | 4.9.5-43.1 |
| SUSE Package Hub 15 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| SUSE Package Hub 15 SP1 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| SUSE Package Hub 15 SP1 | phpMyAdmin | 4.9.5-bp151.3.15.1 |
| Ubuntu 18.04 LTS | phpmyadmin | 4:4.6.6-5ubuntu0.5 |
| Ubuntu Pro 14.04 LTS | phpmyadmin | no fix |
| Ubuntu Pro 16.04 LTS | phpmyadmin | no fix |
| openSUSE Leap 15.1 | phpMyAdmin | 4.9.5-43.1 |
| openSUSE Leap 15.1 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| openSUSE Tumbleweed | phpMyAdmin | 5.1.1-1.2 |