CVE-2020-22452

CriticalCVSS 9.8

Published: 26/01/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.70%

74th percentile - higher than 74% of all known CVEs

Summary

SQL Injection vulnerability in phpMyAdmin 5.x before 5.2.0, located in the getTableCreationQuery function in CreateAddField.php. An attacker can inject malicious SQL queries via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.

Risk Assessment

The risk for the organization includes unauthorized database access, sensitive data leakage, and potential data modification or deletion by an attacker.

Recommendation

Immediately upgrade phpMyAdmin to version 5.2.0 or later, which includes a fix for this SQL injection vulnerability.

Original NVD description (English source)

SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.