CVE-2019-19617: phpMyAdmin unsanitized Git information
Summary
CVE-2019-19617: phpMyAdmin unsanitized Git information. Affects phpmyadmin/phpmyadmin versions < 4.9.2. Fixed in 4.9.2. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2019-19617 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks. The vulnerability identified as CVE-2019-19617 affects phpMyAdmin versions prior to 4.9.2. This vulnerability specifically relates to the handling of Git information within the application. The affected files are 'libraries/classes/Display/GitRevision.php' and 'libraries/classes/Footer.php'.
Vulnerability Detail
The vulnerability in phpMyAdmin allows for the injection of unsanitized Git information. This means that certain Git-related data is not properly escaped, potentially leading to various security issues. Attackers could exploit this vulnerability to execute arbitrary code, perform cross-site scripting (XSS) attacks, or gain unauthorized access to sensitive information. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
4.9.2
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:4.9.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually sanitize the Git information in the affected files. This can be done by escaping any special characters and ensuring that the data is properly validated before being displayed. Here is an example of how to sanitize the Git information in 'libraries/classes/Display/GitRevision.php':
// Sanitize Git information
$gitInfo = htmlspecialchars($gitInfo, ENT_QUOTES, 'UTF-8');
// Validate and display the sanitized Git information
if (!empty($gitInfo)) {
echo $gitInfo;
}
Please note that this is a temporary solution and upgrading to the latest version is still recommended.
Conclusion
The vulnerability identified as CVE-2019-19617 in phpMyAdmin versions prior to 4.9.2 allows for the injection of unsanitized Git information, posing significant security risks. To mitigate these risks, it is crucial to upgrade to the latest version of phpMyAdmin. Additionally, a temporary workaround is available by manually sanitizing the Git information in the affected files. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool that provides a web-based interface for managing MySQL databases. It allows users to perform various database management tasks such as creating, modifying, and deleting databases, tables, and records.
This vulnerability could allow attackers to execute arbitrary code, perform cross-site scripting (XSS) attacks, or gain unauthorized access to sensitive information. It is important to upgrade to the latest version of phpMyAdmin to mitigate these risks.
To fix this vulnerability, you should upgrade phpMyAdmin to version 4.9.2 or later. This update includes the necessary fixes to properly sanitize Git information and prevent potential security issues.
Yes, as a temporary workaround, you can manually sanitize the Git information in the affected files. The provided code snippet demonstrates how to sanitize the Git information in 'libraries/classes/Display/GitRevision.php'. However, it is still recommended to upgrade to the latest version for a permanent solution.
You can find more information about this vulnerability, including the CVE identifier, on the official GitHub advisory page: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pgph-mc4p-f8c3/GHSA-pgph-mc4p-f8c3.json
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
