NetSight
IP …
critical9.8

CVE-2020-26935

phpMyAdmin SQL injection vulnerability

Impact

An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.

Affected packages

EcosystemPackageAffectedFixed in
composerphpmyadmin/phpmyadmin>= 4.9.0, < 4.9.64.9.6

Affected products

VendorProductAffected versions
PhpmyadminPhpmyadmin
from 4.9.0 before 4.9.6
from 5.0.0 before 5.0.3
OpensuseBackports Sle
Version 15.0
OpensuseLeap
Versions 15.1, 15.2
FedoraprojectFedora
Versions 31, 32, 33
DebianDebian Linux
Version 9.0

Weakness classification

CWE-89

References