Bringing MySQL administration to the web

Download 5.2.3
Demo Donate

PMASA-2014-8

Announcement-ID: PMASA-2014-8

Date: 2014-08-17

Summary

Multiple XSS vulnerabilities in browse table, ENUM editor, monitor, query charts and table relations pages

Description

With a crafted database, table or a primary/unique key column name it is possible to trigger an XSS when dropping a row from the table. With a crafted column name it is possible to trigger an XSS in the ENUM editor dialog. With a crafted variable name or a crafted value for unit field it is possible to trigger a self-XSS when adding a new chart in the monitor page. With a crafted value for x-axis label it is possible to trigger a self-XSS in the query chart page. With a crafted relation name it is possible to trigger an XSS in table relations page.

Severity

We consider these vulnerabilities to be non critical.

Mitigation factor

These vulnerabilities can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages.

Affected Versions

Versions 4.0.x (prior to 4.0.10.2), 4.1.x (prior to 4.1.14.3) and 4.2.x (prior to 4.2.7.1) are affected.

Solution

Upgrade to phpMyAdmin 4.0.10.2 or newer, or 4.1.14.3 or newer, or 4.2.7.1 or newer, or apply the patches listed below.

References

Thanks to Ashutosh Dhundhara for reporting the vulnerability in table relations page.

Assigned CVE IDs: CVE-2014-5273

CWE IDs: CWE-661 CWE-79

Patches

The following commits have been made to fix this issue:

The following commits have been made on the 4.0 branch to fix this issue:

The following commits have been made on the 4.1 branch to fix this issue:

More information

For further information and in case of questions, please contact the phpMyAdmin security team at security@phpmyadmin.net.

Announcements