CVE-2013-4997

Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities exist in phpMyAdmin versions 3.5.x prior to 3.5.8.2 and 4.0.x prior to 4.0.4.2 [2]. The vulnerabilities involve insufficient sanitization of user-supplied input. Specifically, arbitrary JavaScript can be injected via a crafted anchor identifier (e.g., #) in the URL when accessing setup/index.php, or via the chartTitle parameter in chart display views [1][2].

Exploitation

An attacker can exploit these vulnerabilities without authentication if they can induce a user to click a crafted link. For the setup/index.php vector, a crafted URL with a JavaScript event in the anchor identifier triggers XSS when the page loads. For the chart title, a malicious chartTitle value containing HTML event attributes leads to script execution when the chart is rendered [2]. No special network position is required beyond the ability to deliver the crafted link to the victim.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's phpMyAdmin session. This can lead to session hijacking, defacement, or redirection to malicious sites. The attack is reflected and requires user interaction (clicking a link). However, the setup interface may be used by administrators, increasing the impact.

Mitigation

The vulnerabilities are fixed in phpMyAdmin versions 3.5.8.2 and 4.0.4.2 [2]. Users should upgrade immediately. There is no known KEV listing. If immediate upgrade is not possible, administrators should restrict access to the setup interface and avoid clicking untrusted links. No workarounds are provided in the references.