GHSA-jgjc-332c-8cmccritical9.8
SQL injection in phpMyAdmin
Impact
An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
phpmyadmin/phpmyadmin Packagist
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 4.9.2Ecosystem versions | 4.9.2 |
Version evidence: OSV · GHSA-jgjc-332c-8cmc
View original version evidence (42 explicit versions)
Original source description
An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2019-18622
- Patch github.com/phpmyadmin/composer/commit/51acbf53564d9b52e78509a5688ec2b68976b5f7
- Source reference lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BA4DGF7KTQS6WA2DRNJSW66L43WB7LRV
- Source reference lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W5GW4KEMNCBQYZCIXEJYC42OEBBN2NSH
- Source reference security.gentoo.org/glsa/202003-39
- Security advisory www.phpmyadmin.net/security/PMASA-2019-5
- Security advisory lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html
- Security advisory lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html