CVE-2020-10803

Vulnerability

Overview

CVE-2020-10803 is a SQL injection vulnerability in phpMyAdmin that can be exploited to achieve stored cross-site scripting (XSS). The flaw resides in the handling of database query results within tbl_get_field.php and libraries/classes/Display/Results.php. When a user retrieves data from a database table (e.g., via the Browse tab), malicious SQL code injected into the database can be executed, leading to XSS when the results are displayed [1][4].

Exploitation

Requirements

An attacker must have the ability to insert specially crafted data into certain database tables accessible through phpMyAdmin. This typically requires some level of database write access. When the victim (e.g., another phpMyAdmin user) views the tainted data, the malicious SQL payload is processed, and the resulting output triggers an XSS attack in the victim's browser [4]. The attack does not require direct interaction with the SQL query interface—it leverages the normal data display functionality.

Impact

Successful exploitation enables an attacker to execute arbitrary JavaScript in the context of the phpMyAdmin session of the victim. This could lead to session hijacking, data exfiltration, or further compromise of the database server, depending on the privileges of the victim. The vulnerability is classified as moderate severity by the phpMyAdmin team [4].

Mitigation

The vulnerability affects phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, with the flaw believed to have been introduced in version 3.4. Users should upgrade to phpMyAdmin 4.9.5 or 5.0.2 or later. The fix is also available via specific git commits (e.g., 46a7aa7cd4ff2be0eeb23721fbf71567bebe69a5) [4]. No workarounds are documented; upgrading is the recommended remediation.