PT-2023-6769 · Unknown+3 · Phpmyadmin+3
CVE-2023-25727
·
Publicado
2023-02-07
·
Atualizado
2025-04-08
CVSS v2.0
5.5
Média
| Vetor | AV:N/AC:L/Au:S/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
phpMyAdmin versions 4.9.11 and earlier
phpMyAdmin versions 5.x before 5.2.1
Description
The issue arises due to inadequate protection of the web page structure in phpMyAdmin, allowing an authenticated user to trigger Cross-site Scripting (XSS) by uploading a crafted .sql file through the drag-and-drop interface. This can be exploited by a remote attacker to conduct an XSS attack.
Recommendations
For phpMyAdmin versions 4.9.11 and earlier, update to version 4.9.11 or later.
For phpMyAdmin versions 5.x before 5.2.1, update to version 5.2.1 or later.
As a temporary workaround, consider disabling the configuration directive
$cfg['enable drag drop import'] to prevent the use of the drag-and-drop upload feature, which would protect against the vulnerability.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Debian
Red Os
Phpmyadmin