CVE-2023-25727

Overview

In phpMyAdmin versions before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger a cross-site scripting (XSS) vulnerability by uploading a specially-crafted .sql file through the drag-and-drop import interface [1][3]. The root cause is a missing escape of the uploaded filename when it is displayed in the import result dialog [4]. Specifically, the filename variable was concatenated directly into HTML via $('body').append(...) without sanitization, allowing an attacker to inject arbitrary JavaScript [4].

Exploitation

To exploit this, an attacker must have a valid phpMyAdmin session (authentication is required) and access to the drag-and-drop import feature. The attacker uploads a .sql file whose filename contains malicious HTML or JavaScript payloads. The filename is then rendered unsanitized in a `` element within the browser's DOM when the import operation completes [2][4]. No special network position is required beyond normal access to the phpMyAdmin interface.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's phpMyAdmin session. This can lead to session hijacking, credential theft, or further malicious actions within the database management interface, all under the identity of the authenticated victim user.

Mitigation

Users should upgrade to phpMyAdmin 4.9.11 or 5.2.1, which include the fix [3]. The vulnerability was patched by escaping the filename using Functions.escapeHtml() [4]. As a workaround, administrators can disable the drag-and-drop import feature by setting $cfg['enable_drag_drop_import'] = false [3]. The vulnerability has existed since version 4.3.0 and is considered moderate severity by the phpMyAdmin team [3].