CVE-2016-2045

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the SQL editor of phpMyAdmin versions 4.5.x prior to 4.5.4. When a crafted SQL query triggers a JSON response, the Content-Type header was not set to application/json, causing the browser to interpret the response as HTML and execute injected scripts. The fix involves setting the correct Content-Type header and adding X-Content-Type-Options: nosniff to prevent content sniffing [1][2].

Exploitation

An attacker must be authenticated to phpMyAdmin and have the ability to execute SQL queries in the SQL editor. By crafting a SQL query that produces specially constructed output, the resulting response is served without the proper JSON Content-Type, allowing the injection of arbitrary web script or HTML that executes in the context of the user's session [2].

Impact

Successful exploitation leads to persistent or reflected cross-site scripting (XSS) within the phpMyAdmin interface. An attacker can execute arbitrary JavaScript in the victim's browser, potentially stealing session cookies, performing actions on behalf of the victim, or defacing the interface [1][2].

Mitigation

Upgrade to phpMyAdmin 4.5.4 or later, which includes commits 0a24f92d081033576bfdd9d4bdec1a54501734c1 and 11496890d7e21786cbfd9fd17ab968f498116b3f that correct the Content-Type header and add anti-sniffing headers [1][2]. No workaround is available for unpatched versions.