Cross-Site Scripting Vulnerability in phpMyAdmin by phpMyAdmin Development Team
CVE-2023-25727

5.4MEDIUM

Key Information:

Vendor
PHPmyadmin
Status
PHPmyadmin
Vendor
CVE Published:
13 February 2023

Summary

In phpMyAdmin versions prior to 4.9.11 and 5.2.1, an authenticated user may exploit a vulnerability by uploading a specially crafted .sql file via the drag-and-drop feature. This can lead to cross-site scripting (XSS) issues, allowing attackers to execute malicious scripts in the context of the user's session. This vulnerability highlights the importance of keeping phpMyAdmin updated and properly reviewing uploaded files to mitigate security risks.

References

https://www.phpmyadmin.net/security/PMASA-2023-1/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.