CVE-2020-5504

In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page

published January 9, 2020

CVSS
—
EPSS
39%
Percentile
98.6
In the wild
Unconfirmed
What it is

In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.39036 · 98.6th percentile
Published
2020-01-09T21:56Z
EPSS history
Timeline
  • 09 JAN 21:56Z
    In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page
    cvelistv5