Fluid Attacks Database

Description

SQL injection in phpMyAdmin An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	phpmyadmin	>=0 <4:4.9.2+dfsg1-1	4:4.9.2+dfsg1-1
packagist	phpmyadmin/phpmyadmin	>=0 <4.9.2	4.9.2
debian 13	phpmyadmin	>=0 <4:4.9.2+dfsg1-1	4:4.9.2+dfsg1-1
debian 12	phpmyadmin	>=0 <4:4.9.2+dfsg1-1	4:4.9.2+dfsg1-1
debian 14	phpmyadmin	>=0 <4:4.9.2+dfsg1-1	4:4.9.2+dfsg1-1

Aliases

1. CVE-2019-186222. NVD-2019-186223. OSV-DEBIAN-2019-186224. OSV-2019-186225. GCVE-2019-186226. SECURITY-TRACKER-CVE-2019-186227. security.gentoo.org

References

1. https://github.com/phpmyadmin/composer/commit/51acbf53564d9b52e78509a5688ec2b68976b5f72. https://lists.fedoraproject.org/archives/list/[email protected]/message/BA4DGF7KTQS6WA2DRNJSW66L43WB7LRV3. https://lists.fedoraproject.org/archives/list/[email protected]/message/W5GW4KEMNCBQYZCIXEJYC42OEBBN2NSH4. https://www.phpmyadmin.net/security/PMASA-2019-55. http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html6. http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.