CVE-2020-22278

HIGH

phpMyAdmin < 5.0.2 - CSV Injection via Export Section

Title source: llm
STIX 2.1

Description

phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents.

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://mega.nz/file/ySQnlQSR#vXzY46mgf0CE2ysYpWpbE4O6T_g37--rtaL8pqdHcQs
Broken Link, Third Party Advisory x_refsource_misc
https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22278.pdf

Scores

CVSS v3 8.8
EPSS 0.0151
EPSS Percentile 71.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-1236
Status published
Products (1)
phpmyadmin/phpmyadmin < 5.0.2
Published Nov 04, 2020
Tracked Since Feb 18, 2026