Download 5.2.1 Try demo Donate

PMASA-2013-9

Announcement-ID: PMASA-2013-9

Date: 2013-07-28

Updated: 2013-07-30

Summary

5 XSS vulnerabilities in setup, chart display, process list, and logo link.

Description

  • In the setup/index.php, using a crafted # hash with a Javascript event, untrusted JS code could be executed.
  • In the Display chart view, a chart title containing HTML code was rendered unescaped, leading to possible JavaScript code execution via events.
  • A malicious user with permission to create databases or users having HTML tags in their name, could trigger an XSS vulnerability by issuing a sleep query with a long delay. In the server status monitor, the query parameters were shown unescaped.
  • By configuring a malicious URL for the phpMyAdmin logo link in the navigation sidebar, untrusted script code could be executed when a user clicked the logo.
  • The setup field for "List of trusted proxies for IP allow/deny" Ajax validation code returned the unescaped input on errors, leading to possible JavaScript execution by entering arbitrary HTML.

Severity

We consider these vulnerabilities to be non critical.

Mitigation factor

The stored XSS vulnerabilities can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required forms. The setup vulnerabilities can only be triggered when a crafted value is entered by the user.

Affected Versions

Versions 3.5.x (prior to 3.5.8.2) and 4.0.x (prior to 4.0.4.2) are affected.

Solution

Upgrade to phpMyAdmin 3.5.8.2 or 4.0.4.2 or newer or apply the patches listed below.

References

Thanks to Emanuel Bronshtein for reporting these issues.

Assigned CVE ids: CVE-2013-4996 CVE-2013-4997

CWE ids: CWE-661 CWE-79 CWE-80

Patches

The following commits have been made to fix this issue:

The following commits have been made on the 3.5 branch to fix this issue:

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.

Announcements