PMASA-2016-26

Announcement-ID: PMASA-2016-26

Date: 2016-06-23

Summary

Multiple XSS vulnerabilities

Description

• A vulnerability was reported allowing a specially crafted table name to cause an XSS attack through the functionality to check database privileges.
  • This XSS doesn't exist in some translations due to different quotes being used there (eg. Czech).
• A vulnerability was reported allowing a specifically-configured MySQL server to execute an XSS attack. This particular attack requires configuring the MySQL server log_bin directive with the payload.
• Several XSS vulnerabilities were found with the Transformation feature
• Several XSS vulnerabilities were found in AJAX error handling
• Several XSS vulnerabilities were found in the Designer feature
• An XSS vulnerability was found in the charts feature
• An XSS vulnerability was found in the zoom search feature

Severity

We consider these attacks to be of moderate severity.

Affected Versions

All 4.6.x versions (prior to 4.6.3), 4.4.x versions (prior to 4.4.15.7), and 4.0.x versions (prior to 4.0.10.16) are affected

Solution

Upgrade to phpMyAdmin 4.6.3, 4.4.15.7, or 4.0.10.16 or newer or apply patches listed below.

References

Thanks to Emanuel Bronshtein @e3amn2l, Nils Juenemann @totally_unknown and Mario Heiderich, Cure53 for reporting these vulnerabilities.

Assigned CVE ids: CVE-2016-5733

CWE ids: CWE-661

Patches

The following commits have been made on the 4.0 branch to fix this issue:

• 975089b
• f662d59
• 288efea
• 02971f7
• abfd979
• b04150e
• b974b56
• 9b6f64b

The following commits have been made on the 4.4 branch to fix this issue:

• d184e4d
• e5ab397
• feb911e
• c14709f
• 50bf399
• 42ff2c1
• 5b7a055
• 98514fa

The following commits have been made on the 4.6 branch to fix this issue:

• 8716855
• d648ade
• be3ecbb
• 895a131
• 7966161
• 615212a
• 4d21b5c
• 960fd1f

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.

Announcements