CVE-2020-22452
CRITICALphpMyAdmin 5.0.0-5.0.1 and 5.0.2-5.1.4 - SQL Injection via tbl_storage_engine or tbl_collation Parameters
Title source: llmDescription
SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.
References (4)
Core 4
Core References
Vendor Advisory
http://phpmyadmin.com
Third Party Advisory
https://github.com/phpmyadmin/phpmyadmin/blob/master/ChangeLog
Exploit, Patch, Third Party Advisory
https://github.com/phpmyadmin/phpmyadmin/issues/15898
Patch, Third Party Advisory
https://github.com/phpmyadmin/phpmyadmin/pull/16004
Scores
CVSS v3
9.8
EPSS
0.0324
EPSS Percentile
87.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (2)
phpmyadmin/phpmyadmin
5.0.0 - 5.0.2Packagist
phpmyadmin/phpmyadmin
5.0.0 - 5.2.0
Published
Jan 26, 2023
Tracked Since
Feb 18, 2026