VYPR
← All advisories
Moderate severityNVD Advisory· Published Jan 22, 2022· Updated Aug 3, 2024

CVE-2022-23807

CVE-2022-23807

Description

An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Authenticated phpMyAdmin users can bypass two-factor authentication for future logins by manipulating their account settings.

Vulnerability

An issue exists in phpMyAdmin versions 4.9 before 4.9.8 and 5.1 before 5.1.2 where a valid authenticated user can manipulate their account to bypass two-factor authentication for future login instances [1][2]. The vulnerability lies in how phpMyAdmin processes a user's two-factor status, allowing an authenticated user to disable or bypass 2FA without proper re-authentication [2].

Exploitation

An attacker must already be authenticated to phpMyAdmin (presumably using their two-factor authentication method) to prepare their account for the bypass [2]. The exact sequence of actions is not publicly detailed, but it involves manipulating account settings to disable or bypass two-factor authentication for subsequent logins [2].

Impact

Successful exploitation allows the attacker to bypass two-factor authentication for that account in future login instances, weakening the security of the account [2]. However, the vendor notes that a user is already permitted to disable two-factor authentication through conventional means, so this vulnerability is not considered severe [2].

Mitigation

Upgrade to phpMyAdmin 4.9.8, 5.1.2, or newer [2]. The fix is implemented in commit ca54f1db050859eb8555875c6aa5d7796fdf4b32 [3]. No workaround is provided; upgrading is the recommended solution [2].

References
  1. NVD - CVE-2022-23807
  2. PMASA-2022-1
  3. security - Fix - 2FA/U2F can be disabled without any code change · phpmyadmin/phpmyadmin@ca54f1d

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
phpmyadmin/phpmyadminPackagist
>= 4.9.0, < 4.9.84.9.8
phpmyadmin/phpmyadminPackagist
>= 5.1.0, < 5.1.25.1.2

Affected products

8

Patches

1
ca54f1db0508

security - Fix - 2FA/U2F can be disabled without any code change

https://github.com/phpmyadmin/phpmyadminWilliam DesportesJan 13, 2022via ghsa
commit
1 file changed · +16 −11
  • libraries/classes/DatabaseInterface.php+16 −11 modified
    @@ -1563,17 +1563,22 @@ public function setCollation($collation)
      */
     public function initRelationParamsCache()
     {
-        if (strlen($GLOBALS['db'])) {
-            $cfgRelation = $this->relation->getRelationsParam();
-            if (empty($cfgRelation['db'])) {
-                $this->relation->fixPmaTables($GLOBALS['db'], false);
-            }
-        }
-        $cfgRelation = $this->relation->getRelationsParam();
-        if (empty($cfgRelation['db']) && isset($GLOBALS['dblist'])) {
-            if ($GLOBALS['dblist']->databases->exists('phpmyadmin')) {
-                $this->relation->fixPmaTables('phpmyadmin', false);
-            }
+        $storageDbName = $GLOBALS['cfg']['Server']['pmadb'] ?? '';
+        // Use "phpmyadmin" as a default database name to check to keep the behavior consistent
+        $storageDbName = $storageDbName !== null
+                            && is_string($storageDbName)
+                            && $storageDbName !== '' ? $storageDbName : 'phpmyadmin';
+
+        // This will make users not having explicitly listed databases
+        // have config values filled by the default phpMyAdmin storage table name values
+        $this->relation->fixPmaTables($storageDbName, false);
+
+        // This global will be changed if fixPmaTables did find one valid table
+        $storageDbName = $GLOBALS['cfg']['Server']['pmadb'] ?? '';
+
+        // Empty means that until now no pmadb was found eligible
+        if (empty($storageDbName)) {
+            $this->relation->fixPmaTables($GLOBALS['db'], false);
         }
     }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.