CVE-2014-4986: phpMyAdmin Cross-Site Scripting Vulnerability in Table or Column Names
Summary
CVE-2014-4986: phpMyAdmin cross-site scripting Vulnerability in Table or Column Names. Affects phpmyadmin/phpmyadmin across 3 version ranges.
>= 4.0.0, < 4.0.10.1
>= 4.1.0, < 4.1.14.2
>= 4.2.0, < 4.2.6
Fixed in 4.0.10.1, 4.1.14.2 or 4.2.6, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2014-4986 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source administration tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks. This vulnerability affects versions 4.0.x, 4.1.x, and 4.2.x of phpMyAdmin. The vulnerability arises due to improper handling of table and column names during the construction of an AJAX confirmation message.
Vulnerability Detail
The vulnerability allows remote authenticated users to inject arbitrary web script or HTML into phpMyAdmin. This can be done by crafting a malicious table or column name. When the user interacts with the affected functionality, the injected script or HTML is executed in the context of the user's browser, potentially leading to cross-site scripting (XSS) attacks. The impact of successful exploitation can range from stealing sensitive information to performing unauthorized actions on behalf of the user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.0.10.14.0.10.1composer require phpmyadmin/phpmyadmin:4.0.10.1 -
>= 4.1.0, < 4.1.14.24.1.14.2composer require phpmyadmin/phpmyadmin:4.1.14.2 -
>= 4.2.0, < 4.2.64.2.6composer require phpmyadmin/phpmyadmin:4.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the patched versions as soon as possible.
Conclusion
The phpMyAdmin cross-site scripting vulnerability in table or column names can be a serious security risk for users of affected versions. It is crucial to upgrade to the patched versions as soon as possible to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source administration tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
Versions 4.0.x, 4.1.x, and 4.2.x of phpMyAdmin are affected by this vulnerability.
An attacker can exploit this vulnerability by crafting a malicious table or column name and tricking a user with sufficient privileges to interact with the affected functionality.
Successful exploitation of this vulnerability can lead to cross-site scripting (XSS) attacks, allowing an attacker to execute arbitrary web script or HTML in the context of the user's browser.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the patched versions of phpMyAdmin.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
