CVE-2020-10803

In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tblgetfield.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.

References

Affected packages

Git / github.com/phpmyadmin/phpmyadmin

Affected ranges

Type

GIT

Repo

https://github.com/phpmyadmin/phpmyadmin

Events

Introduced

6da64cc3b2ba4439574f914f51e161645375be96

Fixed

1651d674d65bdd032071733f57cfff9b496e7d85

Introduced

c124aacc32329f69f3e8189c61c5d82f6d9fcd47

Fixed

4520c9d17291007bc2da9f71836ac8c72fc9a7e5

Database specific

{
    "versions": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.9.5"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.2"
        }
    ]
}

Affected versions

Other

RELEASE_4_0_0

RELEASE_4_0_1RC1

RELEASE_4_0_2

RELEASE_4_0_2RC1

RELEASE_4_0_3

RELEASE_4_0_3RC1

RELEASE_4_0_4

RELEASE_4_0_4RC1

RELEASE_4_0_4_1

RELEASE_4_0_4_2

RELEASE_4_0_5RC1

RELEASE_4_0_6

RELEASE_4_0_6RC1

RELEASE_4_0_6RC2

RELEASE_4_1_0ALPHA1

RELEASE_4_1_0ALPHA2

RELEASE_4_1_0BETA1

RELEASE_4_1_0BETA2

RELEASE_4_1_0RC1

RELEASE_4_1_0RC2

RELEASE_4_1_0RC3

RELEASE_4_2_0

RELEASE_4_2_0ALPHA1

RELEASE_4_2_0ALPHA2

RELEASE_4_2_0BETA1

RELEASE_4_2_0RC1

RELEASE_4_2_10

RELEASE_4_2_10_1

RELEASE_4_2_11

RELEASE_4_2_12

RELEASE_4_2_13

RELEASE_4_2_13_1

RELEASE_4_2_7

RELEASE_4_2_7_1

RELEASE_4_2_8

RELEASE_4_2_8_1

RELEASE_4_2_9

RELEASE_4_2_9_1

RELEASE_4_3_0

RELEASE_4_3_0ALPHA1

RELEASE_4_3_0BETA1

RELEASE_4_3_0RC1

RELEASE_4_3_0RC2

RELEASE_4_3_1

RELEASE_4_3_10

RELEASE_4_3_11

RELEASE_4_3_11_1

RELEASE_4_3_12

RELEASE_4_3_13

RELEASE_4_3_2

RELEASE_4_3_3

RELEASE_4_3_4

RELEASE_4_3_5

RELEASE_4_3_6

RELEASE_4_3_7

RELEASE_4_3_8

RELEASE_4_3_9

RELEASE_4_4_0

RELEASE_4_4_0ALPHA1

RELEASE_4_4_1

RELEASE_4_4_10

RELEASE_4_4_11

RELEASE_4_4_12

RELEASE_4_4_13

RELEASE_4_4_13_1

RELEASE_4_4_14

RELEASE_4_4_14_1

RELEASE_4_4_15

RELEASE_4_4_15_1

RELEASE_4_4_15_2

RELEASE_4_4_1_1

RELEASE_4_4_2

RELEASE_4_4_3

RELEASE_4_4_4

RELEASE_4_4_5

RELEASE_4_4_6

RELEASE_4_4_6_1

RELEASE_4_4_7

RELEASE_4_4_8

RELEASE_4_4_9

RELEASE_4_5_0

RELEASE_4_5_0RC1

RELEASE_4_5_0_1

RELEASE_4_5_0_2

RELEASE_4_5_1

RELEASE_4_5_2

RELEASE_4_5_3

RELEASE_4_5_3_1

RELEASE_4_5_4

RELEASE_4_5_4_1

RELEASE_4_5_5

RELEASE_4_5_5_1

RELEASE_4_6_0

RELEASE_4_6_0ALPHA1

RELEASE_4_6_0RC1

RELEASE_4_6_0RC2

RELEASE_4_6_1

RELEASE_4_6_2

RELEASE_4_6_3

RELEASE_4_6_4

RELEASE_4_6_5

RELEASE_4_6_5_1

RELEASE_4_6_5_2

RELEASE_4_6_6

RELEASE_4_7_0

RELEASE_4_7_0BETA1

RELEASE_4_7_0RC1

RELEASE_4_7_1

RELEASE_4_7_2

RELEASE_4_7_3

RELEASE_4_7_4

RELEASE_4_7_5

RELEASE_4_7_6

RELEASE_4_7_7

RELEASE_4_7_8

RELEASE_4_7_9

RELEASE_4_8_0

RELEASE_4_8_0ALPHA1

RELEASE_4_8_0RC1

RELEASE_4_8_0_1

RELEASE_4_8_1

RELEASE_4_8_2

RELEASE_4_8_3

RELEASE_4_8_4

RELEASE_4_8_5

RELEASE_4_9_0

RELEASE_4_9_0_1

RELEASE_4_9_1

RELEASE_4_9_2

RELEASE_4_9_3

RELEASE_4_9_4

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-10803.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "30"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "31"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.0-NA"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.0-sp1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.1"
            }
        ]
    }
]