2 lines
4.2 KiB
JSON
2 lines
4.2 KiB
JSON
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*","matchCriteriaId":"A0C08FCF-E9D9-4889-A7B3-E44D990B09C9","versionEndExcluding":"4.9.4","versionStartIncluding":"4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*","matchCriteriaId":"98CE1E76-7BF6-4CE0-BF18-DCA1116CCB15","versionEndExcluding":"5.0.1","versionStartIncluding":"5.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*","matchCriteriaId":"9C649194-B8C2-49F7-A819-C635EE584ABF","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server."},{"lang":"es","value":"En phpMyAdmin versiones 4 anteriores a 4.9.4 y versiones 5 anteriores a 5.0.1, una inyección SQL se presenta en la página de cuentas de usuario. Un usuario malicioso podría inyectar SQL personalizado en lugar de su propio nombre de usuario cuando crea consultas en esta página. Un atacante necesita tener una cuenta MySQL válida para acceder al servidor."}],"id":"CVE-2020-5504","lastModified":"2026-06-17T03:21:30.570","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"PARTIAL","baseScore":6.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":8.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2020-01-09T22:15:13.863","references":[{"source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"],"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"},{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html"},{"source":"cve@mitre.org","url":"https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2020-5504.md"},{"source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00011.html"},{"source":"cve@mitre.org","tags":["Patch","Vendor Advisory"],"url":"https://www.phpmyadmin.net/security/PMASA-2020-1/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00011.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"url":"https://www.phpmyadmin.net/security/PMASA-2020-1/"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"nvd@nist.gov","type":"Primary"}]}
|