Self XSS in central columns feature

PMASA-2018-1

Announcement-ID: PMASA-2018-1

Date: 2018-02-20

Summary

Self XSS in central columns feature

Description

A self-cross site scripting (XSS) vulnerability has been reported relating to the central columns feature.

Severity

We consider this vulnerability to be of moderate severity.

Mitigation factor

A valid token must be used in the attack

Affected Versions

Versions 4.7.x (prior to 4.7.8) are affected. Versions since 4.3.0 are also affected, but they are no longer supported.

Solution

Upgrade to phpMyAdmin 4.7.8 or newer or apply patch listed below.

References

Thanks to Mayur Udiniya for finding this vulnerability. His blog post about the vulnerability, https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-in-phpmyadmin

Assigned CVE ids: CVE-2018-7260

CWE ids: CWE-661

Patches

The following commits have been made on the 4.7 branch to fix this issue:

• d2886a3e8745e8845633ae8a0054b5ee4d8babd5

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.