← back
CVE-2020-5504

CVE-2020-5504

EPSS 38.8%
In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.
Affected products
n/a · n/a
public PoCs found — 2
githubgithub.com/xMohamed0/CVE-2020-5504-phpMyAdmin★ 1exploitdbwww.exploit-db.com/exploits/52451unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.htmlhttps://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.htmlhttps://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2020-5504.mdhttps://lists.debian.org/debian-lts-announce/2020/01/msg00011.htmlhttps://www.phpmyadmin.net/security/PMASA-2020-1/