phpMyAdmin SQL injection in Designer feature

CRITICAL 9.8CVE-2019-6798 · GHSA-f732-fxh6-g4qj · Published 26/01/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
phpmyadmin/phpmyadmin Packagist	`< 4.8.5`	`4.8.5`
phpmyadmin phpmyadmin	`≥ 4.5.0, ≤ 4.8.4`	No fix yet

Description

An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature.

NVD description

An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature.

References

nvd.nist.gov/vuln/detail/CVE-2019-6798 · ADVISORY
phpmyadmin/composer · PACKAGE
phpmyadmin.net/security/PMASA-2019-2 · WEB
securityfocus.com/bid/106727 · WEB
phpmyadmin.net/security/PMASA-2019-2 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free