CVE-2020-10804 — SQL Injection in Phpmyadmin
Severity
8.0HIGHNVD
EPSS
2.4%
top 14.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 22
Latest updateMay 24
Description
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9
Affected Packages5 packages
Also affects: Fedora 30, 31, 32
🔴Vulnerability Details
4📋Vendor Advisories
2💬Community
4Bugzilla▶
CVE-2020-10804 phpMyAdmin: SQL vulnerability was found in retrieval of the current username which could result privilege escalation [epel-all]↗2020-03-23
Bugzilla▶
CVE-2020-10804 phpMyAdmin: SQL vulnerability was found in retrieval of the current username which could result privilege escalation [fedora-all]↗2020-03-23
Bugzilla▶
CVE-2020-10804 phpMyAdmin: SQL injection was found in retrieval of the current username which could result privilege escalation↗2020-03-23