CVE-2023-25727: XSS vulnerability in drag-and-drop upload of phpMyAdmin
Summary
CVE-2023-25727: Cross-site Scripting vulnerability in drag-and-drop upload of phpMyAdmin. Affects phpmyadmin/phpmyadmin across 2 version ranges.
>= 4.3.0, < 4.9.11
>= 5.0, < 5.2.1
Fixed in 4.9.11 or 5.2.1, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Bitnami
- phpmyadmin · Debian:11
The same CVE-2023-25727 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular web-based database management tool written in PHP. It provides a user-friendly interface for managing MySQL databases. The drag-and-drop upload feature allows users to conveniently import SQL files into their databases. However, prior to version 4.9.11 and 5.x before 5.2.1, an authenticated user could exploit a cross-site scripting (XSS) vulnerability by uploading a specially crafted .sql file through the drag-and-drop interface.
Vulnerability Detail
The XSS vulnerability in phpMyAdmin allows an attacker to inject malicious scripts into the application, which can then be executed in the context of other users. This can lead to various security risks, such as stealing sensitive information, performing unauthorized actions on behalf of the user, or spreading malware. The vulnerability can be triggered by an authenticated user with the ability to upload files through the drag-and-drop interface.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.3.0, < 4.9.114.9.11composer require phpmyadmin/phpmyadmin:4.9.11 -
>= 5.0, < 5.2.15.2.1composer require phpmyadmin/phpmyadmin:5.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading phpMyAdmin is not immediately feasible, a temporary workaround is to disable the drag and drop upload feature by setting $cfg['enable_drag_drop_import'] to false in the configuration file. This can be done by modifying the config.inc.php file and adding the following line: $cfg['enable_drag_drop_import'] = false;. However, it is strongly recommended to upgrade to the latest patched version as soon as possible.
Conclusion
In conclusion, the XSS vulnerability in phpMyAdmin's drag-and-drop upload feature can be mitigated by upgrading to the latest patched version or by disabling the feature. It is recommended to take immediate action to protect your application from potential exploitation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is a web-based database management tool for MySQL databases. It provides a graphical interface for performing various database operations.
The vulnerability allows an authenticated user to execute arbitrary scripts in the context of other users, potentially leading to information theft, unauthorized actions, or the spread of malware.
To fix this vulnerability, upgrade phpMyAdmin to version 4.9.11 or later for versions 4.x, and version 5.2.1 or later for versions 5.x. Alternatively, you can disable the drag and drop upload feature by setting $cfg['enable_drag_drop_import'] to false in the configuration file.
Yes, you can temporarily disable the drag and drop upload feature by modifying the config.inc.php file and setting $cfg['enable_drag_drop_import'] to false.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-6hr3-44gx-g6wh/GHSA-6hr3-44gx-g6wh.json
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
