CVE-2020-10802
📋 TL;DR
This SQL injection vulnerability in phpMyAdmin allows attackers to execute arbitrary SQL queries by crafting malicious database or table names. Users running affected versions who perform search operations on these malicious databases/tables are vulnerable. The vulnerability stems from improper escaping of parameters in search functionality.
💻 Affected Systems
- phpMyAdmin
📦 What is this software?
Backports Sle by Opensuse
Backports Sle by Opensuse
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Phpmyadmin by Phpmyadmin
Phpmyadmin by Phpmyadmin
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, deletion, or potential server takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized data access, data manipulation, privilege escalation within the database, and potential information disclosure.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions in place.
🎯 Exploit Status
Exploitation requires attacker to create malicious database/table names and victim to perform search operations on them. Multiple security advisories indicate active awareness.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.9.5 for 4.x branch, 5.0.2 for 5.x branch
Vendor Advisory: https://www.phpmyadmin.net/security/PMASA-2020-2/
Restart Required: No
Instructions:
1. Backup your phpMyAdmin configuration and database. 2. Download latest patched version from phpmyadmin.net. 3. Replace existing phpMyAdmin files with patched version. 4. Clear browser cache and verify functionality.
🔧 Temporary Workarounds
Restrict Database/Table Creation
allLimit database/table creation privileges to trusted administrators only
GRANT CREATE ON *.* TO 'admin_user'@'localhost';
REVOKE CREATE ON *.* FROM 'regular_user'@'%';
Disable Search Functionality
allTemporarily disable table search functionality in phpMyAdmin configuration
Add $cfg['Servers'][$i]['AllowUserDropDatabase'] = false; to config.inc.php
🧯 If You Can't Patch
- Implement strict input validation for database and table names
- Restrict phpMyAdmin access to trusted IP addresses only using .htaccess or firewall rules
🔍 How to Verify
Check if Vulnerable:
Check phpMyAdmin version in the interface footer or via version.php fileCheck Version:
grep -i 'version' /path/to/phpmyadmin/libraries/classes/Version.php | head -1Verify Fix Applied:
Verify version is 4.9.5 or higher for 4.x branch, or 5.0.2 or higher for 5.x branch📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed search attempts
- Database/table creation from unexpected sources
Network Indicators:
- SQL error messages in HTTP responses
- Unusual patterns in phpMyAdmin search requests
SIEM Query:
source="phpmyadmin.log" AND ("SQL syntax" OR "You have an error in your SQL syntax")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html
- https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/
- https://www.phpmyadmin.net/security/PMASA-2020-3/
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html
- https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/
- https://www.phpmyadmin.net/security/PMASA-2020-3/
