SQL injection - Code In phpmyadmin/phpmyadmin
Description
phpMyAdmin SQL Injection In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges).
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 packagist | 4.9.5, 5.0.2 | ||
 debian 12 | 4:4.9.5+dfsg1-1 | ||
debian 13 | 4:4.9.5+dfsg1-1 | ||
debian 11 | 4:4.9.5+dfsg1-1 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4. 5. 6. 7. 8.