CVE-2020-10804

Vulnerability

Overview

CVE-2020-10804 is an SQL injection vulnerability found in phpMyAdmin, a popular web-based MySQL administration tool. The flaw resides in the retrieval of the current username in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php. A malicious user with access to the server can create a specially-crafted username that, when processed by vulnerable phpMyAdmin versions, leads to SQL injection [1][2].

Exploitation

To exploit this vulnerability, an attacker must already have some level of access to the server (such as a database user account). The attacker creates a crafted username containing SQL injection payloads. Then, a victim (often another administrator) must be tricked into performing specific actions with that user account, such as editing its privileges [3][4]. The attack is not trivial, as it requires both server access and social engineering, but it can lead to serious consequences.

Impact

Successful exploitation allows the attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access, privilege escalation, or complete compromise of the database server. The vulnerability could also generate server errors for users with certain characters when they attempt to change their MySQL passwords [3][4].

Mitigation

The phpMyAdmin project has released patches and upgrades to address this issue. Users should upgrade to phpMyAdmin 4.9.5 or 5.0.2 or later. Patches are also available as commits in the official repository [3][4]. The vulnerability is considered moderately severe due to the specific preconditions required for exploitation.