SQL injection vulnerability in SearchController
An SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
We consider this flaw to be of moderate severity.
phpMyAdmin 4.9.x releases prior to 4.9.6 and the 5.0.x releases prior to 5.0.3 are affected.
Upgrade to phpMyAdmin 4.9.6 or 5.0.3 or newer or apply patch listed below.
Thanks to André Sá from the SCA AppSec group at Checkmarx for reporting this vulnerability.
Assigned CVE ids: CVE-2020-26935
CWE ids: CWE-661
The following commits have been made to fix this issue:
For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.