Multiple XSS vulnerabilities
- A vulnerability was reported allowing a specially crafted table name to cause an XSS attack through the functionality to check database privileges.
- This XSS doesn't exist in some translations due to different quotes being used there (eg. Czech).
- A vulnerability was reported allowing a specifically-configured MySQL server to execute an XSS attack. This particular attack requires configuring the MySQL server log_bin directive with the payload.
- Several XSS vulnerabilities were found with the Transformation feature
- Several XSS vulnerabilities were found in AJAX error handling
- Several XSS vulnerabilities were found in the Designer feature
- An XSS vulnerability was found in the charts feature
- An XSS vulnerability was found in the zoom search feature
We consider these attacks to be of moderate severity.
All 4.6.x versions (prior to 4.6.3), 4.4.x versions (prior to 220.127.116.11), and 4.0.x versions (prior to 18.104.22.168) are affected
Upgrade to phpMyAdmin 4.6.3, 22.214.171.124, or 126.96.36.199 or newer or apply patches listed below.
Thanks to Emanuel Bronshtein @e3amn2l, Nils Juenemann @totally_unknown and Mario Heiderich, Cure53 for reporting these vulnerabilities.
Assigned CVE ids:
The following commits have been made on the 4.0 branch to fix this issue:
The following commits have been made on the 4.4 branch to fix this issue:
The following commits have been made on the 4.6 branch to fix this issue:
For further information and in case of questions, please contact the
phpMyAdmin team. Our website is