CVE-2020-10804

In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection
vulnerability was found in retrieval of the current username (in
libraries/classes/Server/Privileges.php and
libraries/classes/UserPassword.php). A malicious user with access to the
server could create a crafted username, and then trick the victim into
performing specific actions with that user account (such as editing its
privileges).

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=954667&gt;