Description
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
phpMyAdmin phpMyAdmin
Default version status: unaffected
0 to ≤ 5.2.3affected
pkg:composer/phpmyadmin/phpmyadminReferences
- https://github.com/phpmyadmin/phpmyadmin/commit/ec0c6d8394b70d67798f38b645e39c26ea96a2a3 ↗
- https://github.com/phpmyadmin/phpmyadmin/commit/8d1244a72b3be073418e0e08f6f5506815bc7e65 ↗
- https://github.com/phpmyadmin/phpmyadmin/pull/18698 ↗
- https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Database/Designer/Common.php#L788-L808 ↗
- https://abraxaslabs.tech/research/phpmyadmin-designer-json-sqli ↗
- https://github.com/phpmyadmin/phpmyadmin ↗
- https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-sql-injection-via-designer-savesetting ↗