Vulnerability · Published Oct 10, 2020 · Assigned by mitre
CVE-2020-26935
Critical 9.8
In plain English
A critical-severity security flaw in the phpmyadmin package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 63.7% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)63.7%top 0.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | phpmyadmin | 4:4.9.7+dfsg1-1 | DEBIAN-CVE-2020-26935 |
| Debian:13 | phpmyadmin | 4:4.9.7+dfsg1-1 | DEBIAN-CVE-2020-26935 |
| Debian:14 | phpmyadmin | 4:4.9.7+dfsg1-1 | DEBIAN-CVE-2020-26935 |
| Packagist | phpmyadmin/phpmyadmin | 4.9.6 | GHSA-7ff4-cv53-4cjq |
| Packagist | phpmyadmin/phpmyadmin | 5.0.3 | GHSA-7ff4-cv53-4cjq |
Affected products (as reported)
References
- https://www.phpmyadmin.net/security/PMASA-2020-6/ x_refsource_MISC
- openSUSE-SU-2020:1675 vendor-advisory, x_refsource_SUSE
- FEDORA-2020-4e78c86902 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-eadda524a8 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-43d8624421 vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20201025 [SECURITY] [DLA 2413-1] phpmyadmin security update mailing-list, x_refsource_MLIST
- openSUSE-SU-2020:1806 vendor-advisory, x_refsource_SUSE
- GLSA-202101-35 vendor-advisory, x_refsource_GENTOO
- https://advisory.checkmarx.net/advisory/CX-2020-4281 x_refsource_MISC