PT-2020-18484 · Phpmyadmin+3 · Phpmyadmin+3

Publicado 2020-01-08 · Atualizado 2024-06-15 · CVE-2020-5504

Positive Technologies (AI Summary) · Pt

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Nome do software vulnerável e versões afetadas

Versões do phpMyAdmin de 4.0.0 a 4.9.3

Versões do phpMyAdmin de 5.0.0 a 5.0.0

Descrição

Existe uma vulnerabilidade de injeção de SQL na página de contas de usuário do phpMyAdmin. Um usuário mal-intencionado poderia injetar código SQL personalizado no lugar do seu próprio nome de usuário ao criar consultas nessa página. Um invasor deve ter uma conta MySQL válida para acessar o servidor.

Recomendações

Para as versões 4.0.0 a 4.9.3 do phpMyAdmin, atualize para a versão 4.9.4 ou posterior.

Para as versões 5.0.0 a 5.0.0 do phpMyAdmin, atualize para a versão 5.0.1 ou posterior.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

ALT-PU-2020-1061

ALT-PU-2020-3212

ALT-PU-2021-3657

BIT-PHPMYADMIN-2020-5504

CVE-2020-5504

DLA-2060-1

GHSA-FGJ8-93XX-F6G6

MGASA-2020-0033

OPENSUSE-SU-2020:0056-1

OPENSUSE-SU-2024:11171-1

USN-4639-1

USN-4843-1

Produtos afetados

Alt Linux

Linuxmint

Ubuntu

Phpmyadmin

Referências · 95

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-5504.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-10803.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-10802.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-10804.yaml · Exploit
• 🔥 https://github.com/dipakpanchal456/CVE-2022-23808 · Exploit
• 🔥 https://github.com/dipakpanchal05/CVE-2022-23808 · Exploit
• 🔥 https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2020-5504.md · Exploit
• 🔥 https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html · Exploit
• 🔥 https://exploit-db.com/exploits/52451 · Exploit
• https://github.com/phpmyadmin/phpmyadmin/commit/c86acbf3ed49f69cf38b31879886dd5eb86b6983 · Nota
• https://github.com/phpmyadmin/composer · Nota
• https://osv.dev/vulnerability/MGASA-2020-0033 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-9218 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-18622 · Nota
• https://suse.com/security/cve/CVE-2018-12581 · Nota