CVE-2014-7217: phpMyAdmin cross-site scripting Vulnerability via ENUM value
Summary
CVE-2014-7217: phpMyAdmin cross-site scripting Vulnerability via ENUM value. Affects phpmyadmin/phpmyadmin across 3 version ranges.
>= 4.0.0, < 4.0.10.4
>= 4.1.0, < 4.1.14.5
>= 4.2.0, < 4.2.9.1
Fixed in 4.0.10.4, 4.1.14.5 or 4.2.9.1, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2014-7217 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool written in PHP that is used for managing MySQL databases. It provides a web-based interface for performing various database administration tasks such as creating, modifying, and deleting databases, tables, and records. phpMyAdmin is widely used by developers and administrators to interact with MySQL databases efficiently and securely.
Vulnerability Detail
This vulnerability, identified as CVE-2014-7217, is a cross-site scripting (XSS) vulnerability that affects phpMyAdmin versions 4.0.x, 4.1.x, and 4.2.x. It allows remote authenticated users to inject arbitrary web script or HTML into the application. The vulnerability arises from improper handling of crafted ENUM values during the rendering of the table search and table structure pages. The affected files are libraries/TableSearch.class.php and libraries/Util.class.php. An attacker can exploit this vulnerability by injecting malicious code into an ENUM value, which will then be executed when the affected pages are rendered. This can lead to various security risks, including the theft of sensitive information, session hijacking, and the execution of arbitrary code on the user's browser.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.0.10.44.0.10.4composer require phpmyadmin/phpmyadmin:4.0.10.4 -
>= 4.1.0, < 4.1.14.54.1.14.5composer require phpmyadmin/phpmyadmin:4.1.14.5 -
>= 4.2.0, < 4.2.9.14.2.9.1composer require phpmyadmin/phpmyadmin:4.2.9.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the patched versions of phpMyAdmin as mentioned above.
Conclusion
The phpMyAdmin cross-site scripting vulnerability via ENUM value (CVE-2014-7217) can be a serious security risk for phpMyAdmin installations. It allows remote authenticated users to inject arbitrary web script or HTML, potentially leading to the theft of sensitive information, session hijacking, and the execution of arbitrary code. To mitigate this vulnerability, users should upgrade their phpMyAdmin installations to the latest patched versions. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool used for managing MySQL databases through a web-based interface. It allows users to perform various database administration tasks such as creating, modifying, and deleting databases, tables, and records.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various security risks, including the theft of sensitive information, session hijacking, and the execution of arbitrary code on the user's browser.
This vulnerability affects phpMyAdmin versions 4.0.x, 4.1.x, and 4.2.x. It allows remote authenticated users to inject arbitrary web script or HTML into the application by exploiting improper handling of ENUM values during the rendering of the table search and table structure pages.
The potential risks of this vulnerability include the theft of sensitive information, session hijacking, and the execution of arbitrary code on the user's browser. An attacker can exploit this vulnerability by injecting malicious code into an ENUM value, which will then be executed when the affected pages are rendered.
To protect your phpMyAdmin installation from this vulnerability, it is recommended to upgrade to the patched versions (4.0.10.4, 4.1.14.5, or 4.2.9.1) as soon as possible. These versions include the necessary fixes to properly handle ENUM values and prevent the execution of injected malicious code.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
