Threats affecting pkg:github/phpmyadmin/phpmyadmin

phpMyAdmin versions up to 5.2.3 have a stored cross-site scripting (XSS) vulnerability. This flaw allows database users with CREATE privileges to inject malicious scripts via unescaped table names in the DesignerHistory.display() function. When another user interacts with the affected table name in Designer query mode, the injected script executes in their session.

phpMyAdmin versions through 5.2.3 have an SQL injection vulnerability that allows authenticated users to inject SQL via unescaped col_extra and col_attribute parameters in the /database/central-columns endpoint. This injection affects INSERT and UPDATE queries on the pma__central_columns table executed with controluser privileges, potentially enabling attackers to read or modify other users' configuration-storage data.

phpMyAdmin versions up to 5.2.3 have an authentication bypass vulnerability in the CustomServer::parseAndValidateAssertionResponse() function. This flaw occurs because the function does not verify WebAuthn assertion signatures against stored public keys. An attacker with valid MySQL credentials can exploit this by sending a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor authentication and gain database privileges.

phpMyAdmin versions up to 5.2.3 have a vulnerability where authenticated attackers can bypass two-factor authentication (2FA) by sending a specially crafted request to the /config/set endpoint. This allows attackers with a hijacked session to disable 2FA, making subsequent logins require only the MySQL password.