phpMyAdmin Cross-site Scripting (XSS) Vulnerability in phpmyadmin/phpmyadmin
Summary
CVE-2018-19970: phpMyAdmin Cross-site Scripting (XSS) vulnerability. Affects phpmyadmin/phpmyadmin versions >= 4.0, < 4.8.4. Fixed in 4.8.4. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2018-19970 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks. The vulnerability identified in phpMyAdmin before version 4.8.4 is a Cross-site Scripting (XSS) vulnerability. This type of vulnerability allows an attacker to inject malicious code into a website, which can then be executed by unsuspecting users. In this case, the vulnerability exists in the navigation tree of phpMyAdmin, where an attacker can deliver a payload through a crafted database/table name.
Vulnerability Detail
The XSS vulnerability in phpMyAdmin can be exploited by an attacker to deliver a payload to a user through a specially crafted database/table name. When a user interacts with the navigation tree in phpMyAdmin, the malicious code can be executed in the user's browser, potentially leading to unauthorized actions or data theft. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
4.8.4
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:4.8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading to phpMyAdmin version 4.8.4 or later.
Conclusion
In conclusion, the phpMyAdmin Cross-site Scripting (XSS) vulnerability in the phpmyadmin/phpmyadmin package can allow an attacker to inject malicious code through a crafted database/table name. To mitigate this vulnerability, it is recommended to upgrade to phpMyAdmin version 4.8.4 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized actions or data theft.
The XSS vulnerability in phpMyAdmin allows an attacker to inject malicious code into the navigation tree through a specially crafted database/table name. When a user interacts with the navigation tree, the malicious code can be executed in their browser.
The impact of this vulnerability can vary depending on the attacker's intentions. It could lead to unauthorized actions being performed on the user's behalf or the theft of sensitive data.
To protect your phpMyAdmin installation, it is crucial to upgrade to version 4.8.4 or later, which includes a fix for the XSS vulnerability. Regularly updating your software is an essential part of maintaining the security of your system.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
