CVE-2013-4996

Vulnerability

phpMyAdmin versions 3.5.x prior to 3.5.8.2 and 4.0.x prior to 4.0.4.2 are vulnerable to multiple cross-site scripting (XSS) flaws. These arise from insufficient escaping of user-supplied or externally fetched data in several components: setup/index.php via a crafted hash with a JavaScript event; the chart display view via an unescaped chart title; the server status monitor via unescaped query parameters when a malicious user with database or user creation privileges issues a sleep query with a long delay; the navigation sidebar via a malicious logo URL; the proxy list field in setup via unescaped input in Ajax error responses; and the version check feature via a crafted version.json file from phpmyadmin.net [2][3].

Exploitation

For the stored XSS vectors (database name, user name, logo URL, proxy list), an attacker must be logged into phpMyAdmin because the token-based protection blocks unauthenticated requests to the required forms [2]. The setup XSS vectors require the victim to enter a crafted value. The version.json XSS can be exploited only through a combination of complicated techniques that trick the user into visiting a crafted page [3]. An attacker with permission to create databases or users can include HTML tags in their name; when a victim views the server status monitor with a long-running sleep query, the malicious script executes [2].

Impact

Successful exploitation allows a remote attacker to inject arbitrary web script or HTML in the context of the phpMyAdmin application [2][3]. This can lead to session hijacking, credential theft, or other client-side attacks against an authenticated phpMyAdmin user. The severity is considered non-critical for most vectors, but the version.json XSS is considered serious [2][3].

Mitigation

Upgrade to phpMyAdmin 3.5.8.2 or 4.0.4.2 (released 2013-07-30) [2][3]. Patches are available as commits in the phpMyAdmin repository; apply them if upgrading is not immediately possible [3]. No workarounds are documented; the vendor recommends upgrading to the fixed versions.