phpmyadmin contains SQL Injection vulnerability

CRITICAL 9.8CVE-2020-22452 · BIT-phpmyadmin-2020-22452 · GHSA-prcg-mc23-hgjh · Published 26/01/2023 · updated 09/07/2026

Package	Affected versions	Patched versions
phpmyadmin/phpmyadmin Packagist	`≥ 5.0.0, < 5.0.2`	`5.0.2`
phpmyadmin phpmyadmin	`≥ 5.0.0, < 5.2.0`	`5.2.0`

Description

SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.0.2 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.

NVD description

SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.

References

nvd.nist.gov/vuln/detail/CVE-2020-22452 · ADVISORY
phpmyadmin/phpmyadmin · WEB
phpmyadmin/phpmyadmin#16004 · WEB
phpmyadmin/phpmyadmin commit bc98246 · WEB
phpmyadmin/phpmyadmin · PACKAGE
phpmyadmin/phpmyadmin · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free