PT-2020-5835 · Phpmyadmin+1 · Phpmyadmin+1

Published

2020-10-13

·

Updated

2024-08-04

·

CVE-2020-22278

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: phpMyAdmin versions 5.0.2 and earlier
Description: The issue is related to a lack of neutralization of elements in a CSV file in the "Export" function of the phpMyAdmin web application for database management. This could allow a remote attacker to execute arbitrary code when a specially crafted CSV file is opened. The vulnerability is associated with CSV injection via the Export Section. It is noted that the vendor disputes this issue, stating that the CSV file is accurately generated based on the database contents.
Recommendations: For phpMyAdmin versions 5.0.2 and earlier, consider disabling the "Export" function until a patch is available to prevent potential CSV injection attacks. Restrict access to the Export Section to minimize the risk of exploitation. Avoid using the Export function with untrusted CSV files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

ALT-PU-2020-3037
ALT-PU-2020-3212
ALT-PU-2021-3657
BDU:2021-01804
BIT-PHPMYADMIN-2020-22278
CVE-2020-22278

Affected Products

Alt Linux
Phpmyadmin