CVE-2014-6300: phpMyAdmin micro history Implementation XSS Vulnerability
Summary
CVE-2014-6300: phpMyAdmin micro history Implementation XSS Vulnerability. Affects phpmyadmin/phpmyadmin across 3 version ranges.
>= 4.0.0, < 4.0.10.3
>= 4.1.0, < 4.1.14.4
>= 4.2.0, < 4.2.8.1
Fixed in 4.0.10.3, 4.1.14.4 or 4.2.8.1, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2014-6300 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source administration tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks. The micro history feature in phpMyAdmin allows users to view and navigate through their recent actions within the application. However, a vulnerability in the implementation of this feature allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks and cross-site request forgery (CSRF) attacks to create a root account.
Vulnerability Detail
The vulnerability exists in phpMyAdmin versions 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1. By crafting a malicious URL, an attacker can inject arbitrary web script or HTML into the micro history feature. This can be exploited to execute malicious code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities. Additionally, an attacker can leverage this vulnerability to perform a CSRF attack and create a root account on the affected phpMyAdmin instance.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.0.10.34.0.10.3composer require phpmyadmin/phpmyadmin:4.0.10.3 -
>= 4.1.0, < 4.1.14.44.1.14.4composer require phpmyadmin/phpmyadmin:4.1.14.4 -
>= 4.2.0, < 4.2.8.14.2.8.1composer require phpmyadmin/phpmyadmin:4.2.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can mitigate the risk by disabling the micro history feature in phpMyAdmin. This can be done by modifying the configuration file or settings of the application. However, it is recommended to upgrade to the patched version as soon as possible to ensure comprehensive protection against this vulnerability.
Conclusion
The phpMyAdmin micro history implementation XSS vulnerability poses a moderate risk to users of affected versions. It allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks and cross-site request forgery (CSRF) attacks. To mitigate the risk, users should upgrade to the latest patched version or disable the micro history feature. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source administration tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
The micro history feature in phpMyAdmin allows users to view and navigate through their recent actions within the application. It provides a convenient way to track and undo changes made to the database.
The XSS vulnerability in the micro history implementation allows remote attackers to inject arbitrary web script or HTML into the application. This can be exploited to execute malicious code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities.
This vulnerability can be leveraged by attackers to perform cross-site scripting (XSS) attacks and cross-site request forgery (CSRF) attacks. An attacker can inject malicious code into the application, potentially leading to session hijacking, data theft, or the creation of a root account on the affected phpMyAdmin instance.
To fix this vulnerability, users of phpMyAdmin should upgrade to the latest patched version (4.0.10.3, 4.1.14.4, or 4.2.8.1). Alternatively, users can disable the micro history feature in phpMyAdmin as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
