Vulnerability record · CVE-2020-26935 · published 10 October 2020
CVE-2020-26935: phpMyAdmin SearchController SQL injection via search feature
Phpmyadmin · Phpmyadmin
phpMyAdmin before 4.9.6 and 5.x before 5.0.3 contains a SQL injection flaw in SearchController's handling of SQL statements in the search feature. An attacker can inject malicious SQL into a query, which matters because phpMyAdmin is a database administration tool with broad access to backend data.
Description
An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network reachability, no privileges, no user interaction, and a very high EPSS score make this a high-urgency SQL injection in a widely deployed database administration tool.
What it is
phpMyAdmin before 4.9.6 and 5.x before 5.0.3 contains a SQL injection flaw in SearchController's handling of SQL statements in the search feature. An attacker can inject malicious SQL into a query, which matters because phpMyAdmin is a database administration tool with broad access to backend data.
Impact
An attacker can execute arbitrary SQL against the database phpMyAdmin manages, potentially reading, modifying, or deleting data and, depending on database privileges, escalating further. The CVSS vector rates confidentiality, integrity, and availability impact as high.
Attack surface
The vulnerability is network-reachable (AV:N) with no privileges (PR:N) and no user interaction (UI:N) per the CVSS vector, meaning it can be triggered directly over the network against the search functionality. The description does not specify whether a valid session is required, so that detail is absent from the record.
Exploitation
CISA KEV does not list this CVE, but EPSS is very high at 0.67081 (99.265th percentile), and a Checkmarx advisory is tagged as an Exploit reference, indicating public exploit information exists.
What to do
- Upgrade phpMyAdmin to 4.9.6 or 5.0.3 or later, per the vendor advisory PMASA-2020-6.
- Apply distribution backports for Debian, Fedora, openSUSE, and Gentoo packages where the base version cannot be changed.
- Restrict network access to phpMyAdmin interfaces to trusted management networks or VPN only.
- Run phpMyAdmin's database connections with least-privilege accounts to limit the impact of injected SQL.
- Monitor vendor and distribution advisories for any follow-up patches.
Detection
- Review phpMyAdmin web server and application logs for anomalous SQL syntax or injection patterns in search requests.
- Enable and monitor database query logging for unexpected or malformed SQL originating from phpMyAdmin hosts.
- Alert on access to phpMyAdmin search endpoints from untrusted or unexpected source IPs.
- Check deployed phpMyAdmin versions against 4.9.6 and 5.0.3 to identify unpatched instances.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-26935 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-26935), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
