Описание
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.
Ссылки
- ExploitThird Party Advisory
- Product
- Product
- Patch
- Patch
- Patch
- https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-sql-injection-via-designer-savesettingExploitPatchThird Party Advisory
Уязвимые конфигурации
EPSS
4.2 Medium
CVSS3
8.8 High
CVSS3
Дефекты
Связанные уязвимости
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in De ...
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.
EPSS
4.2 Medium
CVSS3
8.8 High
CVSS3