PT-2020-12335 · Phpmyadmin+3 · Phpmyadmin+3

Bluebird + 1 · Published 2020-03-22 · Updated 2024-06-15 · CVE-2020-10804

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.x through 4.9.4 phpMyAdmin versions 5.x through 5.0.1

Description A SQL injection issue was found in the retrieval of the current username, specifically in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php. This could allow a malicious user with server access to create a crafted username and trick a victim into performing specific actions with that user account, such as editing its privileges.

Recommendations For phpMyAdmin versions 4.x through 4.9.4, update to version 4.9.5 or later. For phpMyAdmin versions 5.x through 5.0.1, update to version 5.0.2 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2020-2100

ALT-PU-2020-3212

ALT-PU-2021-3657

BIT-PHPMYADMIN-2020-10804

CVE-2020-10804

GHSA-H65R-8FP8-W7CX

MGASA-2020-0150

OPENSUSE-SU-2020:0405-1

OPENSUSE-SU-2020:0427-1

OPENSUSE-SU-2020:1806-1

OPENSUSE-SU-2020_0405-1

OPENSUSE-SU-2020_1806-1

OPENSUSE-SU-2024:11171-1

USN-4639-1

Affected Products

Alt Linux

Suse

Ubuntu

Phpmyadmin

References · 91

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-5504.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-10803.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-10802.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-10804.yaml · Exploit
• 🔥 https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2020-5504.md · Exploit
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7260 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0405-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-10804 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-phpmyadmin-2020-10804 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10804 · Vendor Advisory
• https://phpmyadmin.net/security/PMASA-2020-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12616 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-19968 · Vendor Advisory