CVE-2025-24530: phpMyAdmin XSS Vulnerability in Check Tables Feature
Summary
CVE-2025-24530: phpMyAdmin XSS when checking tables. Affects phpmyadmin/phpmyadmin versions >= 5.0.0, < 5.2.2. Fixed in 5.2.2. How to fix ↓
Also tracked for
- phpmyadmin · Bitnami
- phpmyadmin · Debian:11
The same CVE-2025-24530 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely used open-source tool for managing MySQL databases through a web interface. It allows users to perform various database operations, such as creating, modifying, and deleting databases and tables. The tool is known for its user-friendly interface and extensive features, making it a popular choice among developers and database administrators. However, phpMyAdmin versions 5.x prior to 5.2.2 are vulnerable to an XSS (Cross-Site Scripting) attack when using the check tables feature, which can lead to security risks if exploited.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the check tables feature of phpMyAdmin. A crafted table or database name can be used to inject malicious scripts, leading to XSS attacks. This can allow attackers to execute arbitrary JavaScript in the context of the user's browser, potentially stealing sensitive information or performing actions on behalf of the user. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Minimum fixed version
5.2.2
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:5.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the check tables feature until they can update to the patched version. Additionally, sanitizing input for table and database names can help mitigate the risk of XSS attacks.
Conclusion
The XSS vulnerability in phpMyAdmin's check tables feature poses a significant risk to users of versions 5.x prior to 5.2.2. It is crucial for users to update to the latest version to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities in open-source software.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
XSS, or Cross-Site Scripting, is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
If you are using phpMyAdmin version 5.x before 5.2.2, your installation is vulnerable. You can check your version in the phpMyAdmin interface or by looking at the composer.lock file.
If exploited, this vulnerability can allow attackers to execute scripts in the context of a user's session, potentially leading to data theft or unauthorized actions.
Yes, tools like Vulert can monitor your projects for vulnerabilities in real-time using the composer.lock file, alerting you to any issues.
The CVSS score of this vulnerability is 6.4, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
