PT-2023-6769 · Unknown+3 · Phpmyadmin+3

Published 2023-02-07 · Updated 2025-04-08 · CVE-2023-25727

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.9.11 and earlier phpMyAdmin versions 5.x before 5.2.1

Description The issue arises due to inadequate protection of the web page structure in phpMyAdmin, allowing an authenticated user to trigger Cross-site Scripting (XSS) by uploading a crafted .sql file through the drag-and-drop interface. This can be exploited by a remote attacker to conduct an XSS attack.

Recommendations For phpMyAdmin versions 4.9.11 and earlier, update to version 4.9.11 or later. For phpMyAdmin versions 5.x before 5.2.1, update to version 5.2.1 or later. As a temporary workaround, consider disabling the configuration directive $cfg['enable drag drop import'] to prevent the use of the drag-and-drop upload feature, which would protect against the vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-1505

ALT-PU-2023-1600

ALT-PU-2023-7634

BDU:2023-07577

BIT-PHPMYADMIN-2023-25727

CVE-2023-25727

DLA-4121-1

GHSA-6HR3-44GX-G6WH

OPENSUSE-SU-2023:0047-1

OPENSUSE-SU-2023:0058-1

OPENSUSE-SU-2023:0154-1

OPENSUSE-SU-2024:12689-1

Affected Products

Alt Linux

Debian

Red Os

Phpmyadmin

References · 57

• 🔥 https://github.com/dipakpanchal456/CVE-2022-23808 · Exploit
• 🔥 https://github.com/dipakpanchal05/CVE-2022-23808 · Exploit
• https://osv.dev/vulnerability/GHSA-6hr3-44gx-g6wh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25727 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2023:0154-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25727 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2023-1600 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12689-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-4121-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0058-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-25727 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01640 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23808 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24530 · Security Note
• https://phpmyadmin.net/security/PMASA-2023-1 · Vendor Advisory