CVE-2020-5504

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 39.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-01-09 · updated 2026-06-17
Weakness: CWE-89

Description

In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.

Affected products

Debian Linux: 8.0
phpMyAdmin: from 4.0.0 before 4.9.4; from 5.0.0 before 5.0.1 — fixed in 4.9.4, 5.0.1
SUSE Linux Enterprise: 12

How to fix

Upgrade to a fixed version: phpMyAdmin 4.9.4, 5.0.1. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html
https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html
https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2020-5504.md
https://lists.debian.org/debian-lts-announce/2020/01/msg00011.html
https://www.phpmyadmin.net/security/PMASA-2020-1/
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html
https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html
https://lists.debian.org/debian-lts-announce/2020/01/msg00011.html
https://www.phpmyadmin.net/security/PMASA-2020-1/

Get alerted when CVE-2020-5504 or the next vulnerability affects your stack