From d676d6941f9ac1c652873df47f2de96666c1a335 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Wed, 26 Dec 2018 22:48:47 +1100 Subject: [PATCH] Issue phpmyadmin-security/267 SQL injection in Designer feature Signed-off-by: Madhura Jayaratne --- libraries/classes/Database/Designer.php | 3 ++- libraries/classes/Database/Designer/Common.php | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/libraries/classes/Database/Designer.php b/libraries/classes/Database/Designer.php index b013990fa2..875125a488 100644 --- a/libraries/classes/Database/Designer.php +++ b/libraries/classes/Database/Designer.php @@ -200,7 +200,8 @@ class Designer . Util::backquote($cfgRelation['db']) . '.' . Util::backquote($cfgRelation['designer_settings']) . ' WHERE ' . Util::backquote('username') . ' = "' - . $GLOBALS['cfg']['Server']['user'] . '";'; + . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user']) + . '";'; $result = $GLOBALS['dbi']->fetchSingleRow($query); diff --git a/libraries/classes/Database/Designer/Common.php b/libraries/classes/Database/Designer/Common.php index 8f3e1ad31e..4cfeae10c8 100644 --- a/libraries/classes/Database/Designer/Common.php +++ b/libraries/classes/Database/Designer/Common.php @@ -787,8 +787,8 @@ class Common . Util::backquote($cfgDesigner['db']) . "." . Util::backquote($cfgDesigner['table']) . " (username, settings_data)" - . " VALUES('" . $cfgDesigner['user'] . "'," - . " '" . json_encode($save_data) . "');"; + . " VALUES('" . $GLOBALS['dbi']->escapeString($cfgDesigner['user']) + . "', '" . json_encode($save_data) . "');"; $success = $this->relation->queryAsControlUser($query); }