CVE-2020-10802

Vulnerability

Overview

CVE-2020-10802 is a SQL injection vulnerability found in phpMyAdmin, affecting versions 4.x before 4.9.5 and 5.x before 5.0.2. The flaw resides in libraries/classes/Controllers/Table/TableSearchController.php, where certain parameters are not properly escaped when generating queries for search actions [1][4]. An attacker can exploit this by creating a database or table with a specially crafted name that, when a user performs a search operation on that database or table, leads to malicious SQL being injected into the query [4].

Exploitation

To exploit this vulnerability, an attacker must first have the ability to create database objects (databases or tables) in the target phpMyAdmin instance. This could be achieved if the attacker has legitimate database creation privileges or through some other mechanism. The attack is then triggered when a user (such as an administrator) performs a search operation on the maliciously named database or table [4]. The crafted name is injected into the SQL query without proper sanitization, allowing the attacker to execute arbitrary SQL commands. The vulnerability is classified as moderate severity because it requires specific preconditions (creating a malicious database/table and a user performing a search) [4].

Impact

Successful exploitation allows an attacker to perform arbitrary SQL injection, potentially reading, modifying, or deleting data in the underlying MySQL database. The attacker could also potentially gain further access or escalate privileges depending on the database permissions. Given that phpMyAdmin is often used with administrative privileges, this could lead to full compromise of the database server.

Mitigation

The phpMyAdmin project has addressed CVE-2020-10802 in versions 4.9.5 and 5.0.2 [4]. Users are strongly advised to upgrade to these versions or later. Patches are also available in the form of specific commits to the codebase [4]. There are no known workarounds; upgrading is the recommended remediation.