XSS in Designer feature
A Cross-Site Scripting vulnerability was found in the Designer feature, where an attacker can deliver a payload to a user through a specially-crafted database name.
We consider this attack to be of moderate severity.
phpMyAdmin versions prior to 4.8.2.
Upgrade to phpMyAdmin 4.8.2 or newer or apply patch listed below.
Thanks to William Desportes
Assigned CVE ids: CVE-2018-12581
CWE ids: CWE-661
The following commits have been made on the 4.8 branch to fix this issue:
For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.