Server side cross-site scripting In phpmyadmin
Description
Cross-site Scripting vulnerability in drag-and-drop upload of phpMyAdmin
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger Cross-site Scripting (XSS) by uploading a crafted .sql file through the drag-and-drop interface. By disabling the configuration directive $cfg['enable_drag_drop_import'], users will be unable to use the drag and drop upload which would protect against the vulnerability.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 13 | 4:5.2.1+dfsg-1 | ||
 packagist | 4.9.11, 5.2.1 | ||
debian 11 | 4:5.0.4+dfsg2-2+deb11u2 | ||
debian 12 | 4:5.2.1+dfsg-1 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3.