phpMyAdmin SQL injection in Designer feature

CRITICAL 9.8CVE-2019-11768 · GHSA-x37v-98f9-mj32 · Published 05/06/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
phpmyadmin/phpmyadmin Packagist	`< 4.9.0.1`	`4.9.0.1`
phpmyadmin phpmyadmin	`< 4.9.0.1`	`4.9.0.1`

Description

An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature.

NVD description

An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature.

References

nvd.nist.gov/vuln/detail/CVE-2019-11768 · ADVISORY
phpmyadmin/phpmyadmin commit c1ecafc · WEB
phpmyadmin.net/security/PMASA-2019-3 · WEB
lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html
lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html
securityfocus.com/bid/108617
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7
phpmyadmin.net/security/PMASA-2019-3 · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free