Download 5.2.1 Try demo Donate

PMASA-2018-3

Announcement-ID: PMASA-2018-3

Date: 2018-06-19

Updated: 2018-06-21

Summary

XSS in Designer feature

Description

A Cross-Site Scripting vulnerability was found in the Designer feature, where an attacker can deliver a payload to a user through a specially-crafted database name.

Severity

We consider this attack to be of moderate severity.

Affected Versions

phpMyAdmin versions prior to 4.8.2.

Solution

Upgrade to phpMyAdmin 4.8.2 or newer or apply patch listed below.

References

Thanks to William Desportes for discovering this flaw.

Assigned CVE ids: CVE-2018-12581

CWE ids: CWE-661

Patches

The following commits have been made on the 4.8 branch to fix this issue:

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.

Announcements