Description
In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.
Remediation
References
Related Vulnerabilities
WordPress Direct Request ('Forced Browsing') Vulnerability (CVE-2005-1688)
Grafana Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2021-27962)
WordPress 4.4.x Possible SQL Injection Vulnerability (4.4 - 4.4.11)
Oracle Database Server CVE-2009-3410 Vulnerability (CVE-2009-3410)
phpMyAdmin Resource Management Errors Vulnerability (CVE-2016-6622)