In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page.

Summary

In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.

Timeline

1. Jan 9, 2020, 9:56 PM UTCCVE published
2. Apr 16, 2025, 2:13 PM UTCRecord last updated
3. Dec 3, 2025Public exploit on Exploit-DB

   EDB-52451

4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• phpmyadmin/phpmyadminPackagist

  From 4.0.0 · fixed in 4.9.4

• phpmyadmin/phpmyadminPackagist

  From 5.0.0 · fixed in 5.0.1

References 8