Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to the libraries/DatabaseInterface.class.php code for SQL debug output and the js/server_status_monitor.js code for the server monitor page.

- phpMyAdmin 4.1.14.6 [boo#902154] [CVE-2014-8326] This     release fixes cross-site scripting vulnerabilities in     the SQL debug output and server monitor pages. This     developer option is not enabled by default.

  - sf#4562 [security] XSS in debug SQL output

  - sf#4563 [security] XSS in monitor query analyzer

phpMyAdmin 4.2.10.1 (2014-10-21) ================================

  - [security] XSS in debug SQL output

    - [security] XSS in monitor query analyzer

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.5, 4.1.x prior to 4.1.14.6, or 4.2.x prior to 4.2.10.1. It is, therefore, affected by the following cross-site scripting vulnerabilities :

  - The 'libraries/DatabaseInterface.class.php' script does     not validate input to database and table names in SQL     debug output before returning it to users.

  - The 'js/server_status_monitor.js' script does not     validate input to executed queries before they are     viewed or analyzed.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated phpmyadmin package fixes security vulnerability :

In phpMyAdmin before 4.2.10.1, with a crafted database or table name it is possible to trigger an XSS in SQL debug output when enabled and in server monitor page when viewing and analysing executed queries (CVE-2014-8326).

Versions of phpMyAdmin earlier than 4.0.10.5, 4.1.14.6, and 4.2.10.1 are unpatched for cross-site scripting vulnerabilities affecting the SQL debug output and server monitor page. These vulnerabilities can be leveraged to steal cookie-based authentication, among other potential attacks, though note that they can only be leveraged by a logged-in user.

The phpMyAdmin development team reports :

With a crafted database or table name it is possible to trigger an XSS in SQL debug output when enabled and in server monitor page when viewing and analysing executed queries.

This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages. Moreover, debugging SQL is a developer option which is disabled by default and expected to be disabled in production environments.

ID	Name	Product	Family	Severity
78837	openSUSE Security Update : phpMyAdmin (openSUSE-SU-2014:1347-1)	Nessus	SuSE Local Security Checks	low
78807	Fedora 19 : phpMyAdmin-4.2.10.1-1.fc19 (2014-13504)	Nessus	Fedora Local Security Checks	low
78806	Fedora 21 : phpMyAdmin-4.2.10.1-1.fc21 (2014-13479)	Nessus	Fedora Local Security Checks	low
78738	phpMyAdmin 4.0.x < 4.0.10.5 / 4.1.x < 4.1.14.6 / 4.2.x < 4.2.10.1 Multiple XSS (PMASA-2014-12)	Nessus	CGI abuses : XSS	low
78714	Fedora 20 : phpMyAdmin-4.2.10.1-1.fc20 (2014-13521)	Nessus	Fedora Local Security Checks	low
78687	Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2014:208)	Nessus	Mandriva Local Security Checks	low
8564	phpMyAdmin 4.0.x < 4.0.10.5 / 4.1.x < 4.1.14.6 / 4.2.x < 4.2.10.1 Multiple XSS (PMASA-2014-12)	Nessus Network Monitor	CGI	low
78634	FreeBSD : phpMyAdmin -- XSS vulnerabilities in SQL debug output and server monitor page. (25b78f04-59c8-11e4-b711-6805ca0b3d42)	Nessus	FreeBSD Local Security Checks	low

Detections

Analytics

CVE-2014-8326

medium

Tenable Plugins

low

low

low

low

low

low

low

low