VYPR
← All advisories
Moderate severityNVD Advisory· Published Jun 21, 2018· Updated Aug 5, 2024

CVE-2018-12581

CVE-2018-12581

Description

An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Cross-Site Scripting in phpMyAdmin Designer feature via crafted database name allows remote attackers to execute arbitrary script in users' browsers.

Vulnerability

A Cross-Site Scripting (XSS) vulnerability exists in the js/designer/move.js file of phpMyAdmin versions before 4.8.2 [1]. The Designer feature does not properly escape database names when generating URLs, allowing an attacker to inject arbitrary JavaScript code via a crafted database name [1][2].

Exploitation

An attacker must have the ability to create or rename a database with a malicious name containing JavaScript payload. When a user accesses the Designer feature referencing that database, the injected script executes in the user's browser context [3]. No authentication is required for the attacker to create a database if they have database creation privileges, but the victim must be an authenticated phpMyAdmin user [2].

Impact

Successful exploitation allows the attacker to execute arbitrary HTML and JavaScript in the victim's browser within the phpMyAdmin session. This can lead to theft of authentication cookies, access to recently submitted form data, or actions performed on behalf of the victim user, potentially compromising the entire phpMyAdmin installation [4].

Mitigation

The vendor has released phpMyAdmin version 4.8.2, which fixes the issue by properly escaping database names in URLs [3]. Users should upgrade to this version or later. No workarounds are available for earlier versions. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

References
  1. NVD - CVE-2018-12581
  2. phpMyAdmin CVE-2018-12581 Cross Site Scripting Vulnerability
  3. Escape database name in URL · phpmyadmin/phpmyadmin@6943fff
  4. phpMyAdmin Input Validation Flaw in Designer Feature Lets Remote Users Conduct Cross-Site Scripting Attacks

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
phpmyadmin/phpmyadminPackagist
< 4.8.24.8.2

Affected products

3

Patches

1
6943fff87324

Escape database name in URL

https://github.com/phpmyadmin/phpmyadminWilliam DesportesJun 9, 2018via ghsa
commit
1 file changed · +1 −1
  • js/designer/move.js+1 −1 modified
    @@ -1117,7 +1117,7 @@ function Load_page (page) {
         if (page !== null) {
             param_page = argsep + 'page=' + page;
         }
-        $('<a href="db_designer.php?server=' + server + argsep + 'db=' + db + param_page + '"></a>')
+        $('<a href="db_designer.php?server=' + server + argsep + 'db=' + encodeURI(db) + param_page + '"></a>')
             .appendTo($('#page_content'))
             .click();
     } else {

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.