phpMyAdmin Cross-site scripting (XSS) vulnerability in central columns feature
Summary
CVE-2018-7260: phpMyAdmin Cross-site scripting (XSS) vulnerability in central columns feature. Affects phpmyadmin/phpmyadmin versions < 4.7.8. Fixed in 4.7.8. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2018-7260 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks. The central columns feature in phpMyAdmin allows users to view and modify the structure of database tables. This feature is vulnerable to a cross-site scripting (XSS) attack, which can be exploited by remote authenticated users. An attacker can inject arbitrary web script or HTML into the application via a crafted URL.
Vulnerability Detail
The vulnerability in phpMyAdmin's central columns feature arises from inadequate input sanitization. When a user interacts with the db_central_columns.php script, the application fails to properly validate and sanitize user-supplied input. This allows an attacker to inject malicious code into the application, which is then executed in the context of other users' sessions. The impact of this vulnerability can range from stealing sensitive information, such as login credentials, to performing unauthorized actions on behalf of the targeted user.
How To Fix
Minimum fixed version
4.7.8
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:4.7.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the central columns feature in phpMyAdmin. This can be done by modifying the application's configuration file or by restricting access to the db_central_columns.php script. By disabling this feature, the risk of exploitation can be mitigated until a proper upgrade can be performed.
Conclusion
The phpMyAdmin central columns feature is vulnerable to a cross-site scripting (XSS) attack. This can allow remote authenticated users to inject malicious code into the application, potentially leading to the theft of sensitive information or unauthorized actions. It is crucial to upgrade phpMyAdmin to version 4.7.8 or later to fix this vulnerability. If immediate upgrade is not possible, disabling the central columns feature can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
The central columns feature in phpMyAdmin allows users to view and modify the structure of database tables. It provides a convenient way to manage the columns of a table.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the theft of sensitive information or the execution of unauthorized actions.
The phpMyAdmin XSS vulnerability can be exploited by remote authenticated users who can inject malicious code into the application via a crafted URL. This code is then executed in the context of other users' sessions, potentially leading to the theft of sensitive information or unauthorized actions.
To fix the phpMyAdmin XSS vulnerability, it is recommended to upgrade phpMyAdmin to version 4.7.8 or later. This version includes a patch that addresses the vulnerability. Alternatively, you can disable the central columns feature in phpMyAdmin as a temporary workaround until the upgrade can be performed.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.