Cross-site scripting in phpMyAdmin - CVE-2014-7217
Published: October 3, 2014 / Updated: July 28, 2020
Vulnerability details
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when processing data passed via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page, related to libraries/TableSearch.class.php and libraries/Util.class.php. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Affected software
phpmyadmin (Alpine package)
phpMyAdmin4
phpMyAdmin
Fedora
How to mitigate CVE-2014-7217
phpmyadmin (Alpine package) - update to 4.0.10.4-r0
phpMyAdmin4 - update to 4.0.10.4-1.el5
phpMyAdmin - addressed in versions 4.0.10.4-1.el6, 4.2.9.1-1.el7, 4.2.9.1-1.fc21
External References
- http://lists.opensuse.org/opensuse-updates/2014-10/msg00009.html
- http://secunia.com/advisories/61777
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php
- http://www.securityfocus.com/bid/70252
- https://github.com/phpmyadmin/phpmyadmin/commit/304fb2b645b36a39e03b954fdbd567173ebe6448
- https://github.com/phpmyadmin/phpmyadmin/commit/c1a3f85fbd1a9569646e7cf1b791325ae82c7961