Announcement-ID: PMASA-2014-8
Date: 2014-08-17
Multiple XSS vulnerabilities in browse table, ENUM editor, monitor, query charts and table relations pages
With a crafted database, table or a primary/unique key column name it is possible to trigger an XSS when dropping a row from the table. With a crafted column name it is possible to trigger an XSS in the ENUM editor dialog. With a crafted variable name or a crafted value for unit field it is possible to trigger a self-XSS when adding a new chart in the monitor page. With a crafted value for x-axis label it is possible to trigger a self-XSS in the query chart page. With a crafted relation name it is possible to trigger an XSS in table relations page.
We consider these vulnerabilities to be non critical.
These vulnerabilities can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages.
Versions 4.0.x (prior to 4.0.10.2), 4.1.x (prior to 4.1.14.3) and 4.2.x (prior to 4.2.7.1) are affected.
Upgrade to phpMyAdmin 4.0.10.2 or newer, or 4.1.14.3 or newer, or 4.2.7.1 or newer, or apply the patches listed below.
Thanks to Ashutosh Dhundhara for reporting the vulnerability in table relations page.
Assigned CVE ids: CVE-2014-5273
The following commits have been made to fix this issue:
The following commits have been made on the 4.0 branch to fix this issue:
The following commits have been made on the 4.1 branch to fix this issue:
For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.