CVE-2018-15605: phpMyAdmin Cross-site Scripting (XSS) in the import dialog
Summary
CVE-2018-15605: phpMyAdmin Cross-site Scripting (XSS) in the import dialog. Affects phpmyadmin/phpmyadmin versions < 4.8.3. Fixed in 4.8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source administration tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks such as creating, modifying, and deleting databases, tables, and records. The import feature in phpMyAdmin allows users to upload and import SQL files into their databases. This vulnerability affects phpMyAdmin versions prior to 4.8.3.
Vulnerability Detail
A Cross-Site Scripting (XSS) vulnerability has been discovered in phpMyAdmin. This vulnerability can be exploited by an attacker who uploads a specially crafted file through the import feature. When an authenticated user loads the imported file, the malicious code within the file can be executed in the user's browser, potentially leading to unauthorized actions or data theft. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
4.8.3
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:4.8.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of phpMyAdmin as soon as possible.
Conclusion
In conclusion, phpMyAdmin versions prior to 4.8.3 are vulnerable to a Cross-Site Scripting (XSS) attack through the import feature. Users should upgrade to phpMyAdmin 4.8.3 or later to fix this vulnerability. There is no known workaround, so upgrading is the recommended course of action. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source administration tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
The import feature in phpMyAdmin allows users to upload and import SQL files into their databases. This is useful for restoring backups or transferring data between databases.
The XSS vulnerability in phpMyAdmin allows an attacker to execute malicious code in the browser of an authenticated user who loads a specially crafted file through the import feature. This can lead to unauthorized actions or data theft.
The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of phpMyAdmin to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
