CVE-2011-3592: phpMyAdmin Multiple XSS Vulnerabilities
Summary
CVE-2011-3592: phpMyAdmin Multiple XSS Vulnerabilities. Affects phpmyadmin/phpmyadmin versions >= 3.4.0, < 3.4.5. Fixed in 3.4.5. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2011-3592 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool written in PHP that provides a web-based interface for managing MySQL databases. It allows users to perform various database management tasks such as creating, modifying, and deleting databases, tables, and columns. This vulnerability affects phpMyAdmin versions 3.4.x before 3.4.5. The vulnerability arises from multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in the js/sql.js file. These vulnerabilities can be exploited by remote authenticated users to inject arbitrary web script or HTML into the application.
Vulnerability Detail
The vulnerability stems from improper handling of user-supplied input after an inline-editing operation in phpMyAdmin. Specifically, the PMA_unInlineEditRow function does not properly sanitize user input when displaying database, table, or column names. This allows an attacker to inject malicious script or HTML code, which will be executed in the context of other users accessing the affected pages. The impact of this vulnerability can range from stealing sensitive information, such as session cookies, to performing actions on behalf of the victim user.
How To Fix
Minimum fixed version
3.4.5
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:3.4.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable inline editing functionality in phpMyAdmin. This can be done by modifying the configuration file or disabling the corresponding JavaScript file (js/sql.js). However, this workaround may impact the user experience and should only be considered as a temporary measure until the upgrade can be performed.
Conclusion
In conclusion, phpMyAdmin versions 3.4.x before 3.4.5 are vulnerable to multiple XSS vulnerabilities that can be exploited by remote authenticated users. Upgrading to version 3.4.5 or later is the recommended solution to fix this vulnerability. If immediate upgrade is not possible, disabling inline editing functionality can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases through a web-based interface. It provides a convenient way to perform various database management tasks.
Versions 3.4.x before 3.4.5 of phpMyAdmin are affected by this vulnerability.
Remote authenticated users can exploit this vulnerability by injecting malicious script or HTML code into database, table, or column names. This code will be executed in the context of other users accessing the affected pages.
The consequences of this vulnerability can vary, but they may include stealing sensitive information, such as session cookies, or performing unauthorized actions on behalf of the victim user.
Yes, a temporary workaround is to disable inline editing functionality in phpMyAdmin. However, this may impact the user experience and should only be considered as a temporary measure until the upgrade to version 3.4.5 or later can be performed.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
