CVE-2012-4345

Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities exist in the Database Structure page of phpMyAdmin versions 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 [1][2]. The page fails to properly sanitize table names, allowing injection of arbitrary web script or HTML when a crafted table name is used during table creation, or when the Empty or Drop links for such a table are clicked [1]. Additional related XSS issues also affect the Table Operations, Triggers, and GIS data visualization pages [2].

Exploitation

An attacker must have authenticated access to phpMyAdmin. They can either create a table with a crafted name or rely on an existing table with a malicious name already present in the database [2]. When the Database Structure page is loaded, the crafted table name is rendered unsanitized, causing the XSS payload to execute. Alternatively, clicking the Empty or Drop links for the crafted table triggers the injection [1]. No special privileges beyond a valid user account are required.

Impact

Successful exploitation allows the attacker to inject arbitrary web script or HTML into the phpMyAdmin interface, operating within the security context of the authenticated user. This can lead to session hijacking, defacement, theft of sensitive database credentials, or further attacks against the database server [1][2].

Mitigation

Upgrade to phpMyAdmin 3.4.11.1 or 3.5.2.2 or later, which contain the necessary fixes [2]. Patches are available in the referenced commits [2]. Linux distributions such as Mandriva have released updated packages (e.g., phpmyadmin-3.4.11.1) [3]. No workarounds are documented; upgrading is the recommended action.