CVE-2018-19970

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the navigation tree component of phpMyAdmin versions 4.0 through 4.8.3. The bug allows an attacker to craft a database or table name containing a malicious payload, which is then rendered unsanitized in the navigation tree interface when a logged-in user browses the database server [1][3].

Exploitation

An attacker must first have valid credentials to log in to phpMyAdmin and create databases or tables, as the token-based protection prevents unauthenticated users from accessing the required forms [3]. Once authenticated, the attacker creates a database or table with a name containing embedded JavaScript (e.g., ``). When the victim (also logged in) views the navigation tree, the payload executes in the context of the phpMyAdmin session [1][3]. No additional user interaction beyond navigating the tree is required.

Impact

Successful exploitation results in stored XSS, allowing the attacker to execute arbitrary JavaScript in the victim's browser within the phpMyAdmin application context. This can lead to session hijacking, credential theft, or manipulation of the database management interface [1][3]. The attack is limited to authenticated users but can affect multiple users within the organization.

Mitigation

The vulnerability is fixed in phpMyAdmin 4.8.4, released December 7, 2018 [3]. Users should upgrade to version 4.8.4 or later. If upgrading is not immediately possible, the commit b293ff5f234ef493336ed8638f623a12164d359e on the 4.8 branch provides a patch [3]. There is no known workaround [4].