External risk intelligence

phpMyAdmin SQL Injection in Table Creation Function

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2020-22452

phpMyAdmin is a widely used web-based administration tool for MySQL and MariaDB databases. It is frequently deployed as an internet-facing web interface for database management, making the application surface commonly accessible over the network in many production and development environments.

SQL Injection

Phpmyadmin

5.0.0 to before 5.2.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical SQL injection vulnerability in phpMyAdmin, a web-based database administration tool. The flaw, if exploited, could allow unauthorized access and manipulation of database information, potentially impacting data integrity and availability. The main concern is confirming relevance and exposure within your environment.

Allows unauthorized database access and control.
Widespread use of phpMyAdmin increases potential impact.
Assess your phpMyAdmin instances for exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target the `tbl_create.php` page of phpMyAdmin, specifically the `getTableCreationQuery` function within `CreateAddField.php`. By manipulating the `tbl_storage_engine` or `tbl_collation` parameters, they can inject malicious SQL code. If successful, this could allow an attacker to gain significant control over the database.

Exposed to network.
Injects SQL via parameters.
High impact to data integrity.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in phpMyAdmin could allow an unauthenticated attacker to execute arbitrary SQL commands. This could occur when the `tbl_create.php` script processes the `tbl_storage_engine` or `tbl_collation` parameters, potentially affecting the integrity and availability of the underlying database.

Database structure and data integrity.
Via specially crafted input to database creation functions.
Unauthorized database access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The phpMyAdmin team, application owners, and infrastructure teams are primarily responsible for addressing this SQL injection vulnerability. The first critical step is to identify all instances of the affected phpMyAdmin versions, confirm their accessibility, and assess their business criticality. This will enable prioritized remediation planning.

Identify and inventory all phpMyAdmin instances.
Verify network exposure and impact.
Plan and execute remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is phpMyAdmin?

phpMyAdmin is a popular, open-source software tool written in PHP that provides a web-based interface for managing MySQL and MariaDB databases. It is widely used by developers and administrators to perform database tasks like creating, modifying, or deleting tables and data through a browser, rather than using command-line tools.

What does CVE-2020-22452 mean?

This CVE refers to a SQL Injection vulnerability, which is classified as CWE-89. It means the application fails to properly sanitize user input, allowing an attacker to insert malicious SQL commands into the database query process. By manipulating specific fields in the table creation page, an unauthorized person could potentially manipulate, access, or destroy data within the connected database.

How is this vulnerability triggered?

The issue is triggered when a user provides specifically crafted input to the tbl_storage_engine or tbl_collation parameters within the tbl_create.php page. Simply viewing the page or performing standard, legitimate administrative tasks does not trigger this flaw. The malicious impact relies on an attacker actively submitting manipulated data designed to subvert the underlying SQL command logic.

Is my phpMyAdmin instance at risk?

If you are running any version from 5.0.0 up to, but not including, 5.2.0, you are affected. Halo Surface Signal identifies phpMyAdmin as a tool frequently deployed with internet-facing access for remote management. Because the attack vector is network-based, instances exposed to the internet or wide-reaching internal networks are at a significantly higher risk than those isolated from unauthorized traffic.

What should I do to secure my system?

The primary step is to conduct an inventory to locate all phpMyAdmin installations within your environment. Once identified, verify which instances are accessible over the network. Since this vulnerability is addressed in newer releases, upgrading to a version of phpMyAdmin 5.2.0 or later is the necessary action to remediate the flaw and protect your database integrity.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.