An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.

The version of phpMyAdmin installed on the remote host does not correctly handle malicious filenames leading to a leading to a Cross-Site Scripting (XSS) vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for phpMyAdmin to version 4.8.3 addresses multiple issues.

Security issues fixed :

  - CVE-2018-15605: vulnerability in the file import feature     allowed cross-site scripting via importing a specially     crafted file (PMASA-2018-5, boo#1105726)

This update also contains a number of upstream bug fixes in the UI and behavior.

Upstream announcement :

**Security fix: phpMyAdmin 4.8.3 is released**

The phpMyAdmin team is pleased to announce the release of phpMyAdmin version 4.8.2. Among other bug fixes, this contains a security fix for an issue that can be exploited when importing files.

A flaw was discovered with how warning messages are displayed while importing a file. This attack requires a specially crafted file but can allow an attacker to trick the user in to executing a cross-site scripting (XSS) attack. We recommend updating immediately to mitigate this attack.

In addition to the security fixes, this release also includes these bug fixes and more as part of our regular release cycle :

  - An error where a database is named 0

  - Fix for NULL as default not being shown

  - Fix for recent tables list

  - Fix for slow performance with table filtering

  - Two-factor authentication (2FA) fails if the GD PHP     library is missing

  - Event scheduler toggle does not work

  - ERR_BLOCKED_BY_XSS_AUDITOR error when exporting a table

  - PHP 7.3 warning: 'continue' in 'switch' is equal to     'break'

And several more. Complete notes are in the ChangeLog file included with this release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is prior to 4.8.3. It is, therefore, affected by a cross-site Scripting vulnerability.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The phpMyAdmin development team reports : Description A Cross-Site Scripting vulnerability was found in the file import feature, where an attacker can deliver a payload to a user through importing a specially crafted file. Severity We consider this attack to be of moderate severity.

ID	Name	Product	Family	Severity
113290	phpMyAdmin 4.x < 4.8.3 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
123281	openSUSE Security Update : phpMyAdmin (openSUSE-2019-643)	Nessus	SuSE Local Security Checks	medium
120901	Fedora 28 : phpMyAdmin (2018-f2b24ce26e)	Nessus	Fedora Local Security Checks	medium
117334	phpMyAdmin < 4.8.3 Vulnerability (PMASA-2018-5)	Nessus	CGI abuses : XSS	medium
112144	openSUSE Security Update : phpMyAdmin (openSUSE-2018-939)	Nessus	SuSE Local Security Checks	medium
112072	FreeBSD : phpmyadmin -- XSS in the import dialog (9e205ef5-a649-11e8-b1f6-6805ca0b3d42)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2018-15605

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium