CVE-2025-24530: phpMyAdmin XSS Vulnerability in Check Tables Feature
Summary
CVE-2025-24530: An issue was discovered in phpMyAdmin 5.x before 5.2.2. Affects phpmyadmin versions >= 5.0.0, < 5.2.2. Fixed in 5.2.2. How to fix ↓
Also tracked for
- phpmyadmin/phpmyadmin · Packagist
- phpmyadmin · Debian:11
The same CVE-2025-24530 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely used open-source tool for managing MySQL databases through a web interface. It provides functionalities such as database creation, user management, and executing SQL queries. The tool is popular among developers and database administrators for its ease of use and extensive features. However, like any software, it is susceptible to vulnerabilities, including the recently identified XSS vulnerability affecting versions 5.x prior to 5.2.2.
Vulnerability Detail
An XSS (Cross-Site Scripting) vulnerability has been discovered in phpMyAdmin versions 5.x before 5.2.2, specifically within the check tables feature. This vulnerability arises when a crafted table or database name is processed, allowing an attacker to inject malicious scripts that could be executed in the context of the user's browser. The implications of this vulnerability are significant, as it could lead to unauthorized actions being performed on behalf of the user, potentially compromising sensitive data and user accounts.
How To Fix
Minimum fixed version
5.2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the phpMyAdmin interface to trusted IP addresses only. This can be done by configuring your web server settings to allow access only from specific IPs, thereby reducing the risk of exploitation.
Conclusion
The XSS vulnerability identified as CVE-2025-24530 in phpMyAdmin poses a significant risk to users of versions 5.x prior to 5.2.2. It is crucial for users to update to the patched version to safeguard against potential exploitation. Additionally, implementing access restrictions can serve as a temporary measure to mitigate risks.
See every vulnerability recorded for phpmyadmin →
FAQ
The vulnerability is an XSS issue that allows attackers to inject malicious scripts through crafted table or database names.
phpMyAdmin versions 5.x prior to 5.2.2 are affected by this vulnerability.
Exploitation of this vulnerability could allow attackers to perform unauthorized actions in the context of the user's session, potentially compromising sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, you can restrict access to the phpMyAdmin interface to trusted IP addresses as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
