CVE-2020-22452
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
SQL Injection vulnerability in phpMyAdmin 5.x before 5.2.0, located in the getTableCreationQuery function in CreateAddField.php. An attacker can inject malicious SQL queries via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.
Risk Assessment
The risk for the organization includes unauthorized database access, sensitive data leakage, and potential data modification or deletion by an attacker.
Recommendation
Immediately upgrade phpMyAdmin to version 5.2.0 or later, which includes a fix for this SQL injection vulnerability.
Other vulnerabilities in phpMyAdmin
See all- CVE-2017-1000018High
phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a DoS attack in the replication status by using a specially crafted table name.
- CVE-2017-1000017High
phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a weakness that allows a user with appropriate permissions to connect to an arbitrary MySQL server.
- CVE-2017-1000014High
phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a DoS weakness in the table editing functionality.
- CVE-2016-6621High
The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
- CVE-2016-9864High
An issue was discovered in phpMyAdmin that allows SQL injection via a crafted username or table name in the tracking functionality. The executed statements run with the privileges of the control user, granting access to configuration storage database tables and, if the control user has the necessary privileges, to some MySQL database tables.
- CVE-2016-9863High
An issue was discovered in phpMyAdmin that allows for a Denial of Service (DoS) attack through a very large request to the table partitioning function. All 4.6.x versions prior to 4.6.5 are affected.
- CVE-2016-9862High
An issue was discovered in phpMyAdmin that allows for BBCode injection on the login page via a crafted login request. All 4.6.x versions (prior to 4.6.5) are affected.
- CVE-2016-9861High
An issue was discovered in phpMyAdmin related to the limitation in URL matching, allowing for the bypass of URL white-list protection. This affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18).
- CVE-2016-6633High
An issue was discovered in phpMyAdmin that can lead to remote code execution in certain PHP installations running with the dbase extension. This affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).
- CVE-2016-6631High
An issue was discovered in phpMyAdmin that allows for remote code execution when the application is run as CGI. A user can pass a query string that is executed as a command-line argument by the file generator_plugin.sh.
Original NVD description (English source)
SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.