CVE-2020-22452

SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.

Published: Jan 26, 2023
Updated: May 9, 2024
CVE: CVE-2020-22452
GHSA: GHSA-prcg-mc23-hgjh
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWEs:

CWE-89

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
phpmyadmin / phpmyadmin	5.0.0	5.2.0
phpmyadmin / phpmyadmin	5.0.0	5.0.2

http://phpmyadmin.com
https://github.com/phpmyadmin/phpmyadmin/blob/master/ChangeLog
https://github.com/phpmyadmin/phpmyadmin/commit/bc982466f08ddccad4804ba928f84ff8e25107cb
https://github.com/phpmyadmin/phpmyadmin/issues/15898
https://github.com/phpmyadmin/phpmyadmin/pull/16004

Vulnerability Database

CVE-2020-22452

Deep Security Visibility Without the Complexity