NetSight
IP …
medium5.4

CVE-2020-10803

phpMyAdmin SQL injection vulnerability

Impact

In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.

Affected packages

EcosystemPackageAffectedFixed in
composerphpmyadmin/phpmyadmin>= 3.4, < 4.9.54.9.5

Affected products

VendorProductAffected versions
PhpmyadminPhpmyadmin
from 4.0.0 before 4.9.5
from 5.0.0 before 5.0.2
DebianDebian Linux
Version 8.0
FedoraprojectFedora
Versions 30, 31, 32
OpensuseBackports Sle
Version 15.0
OpensuseLeap
Version 15.1
SusePackage Hub
All versions

Weakness classification

CWE-79CWE-89

References