From c5783321cd387d0b65b32cf399766f08a9acad68 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Mon, 17 Nov 2014 12:13:09 +0530 Subject: [PATCH] bug #4598 [security] XSS in multi submit Signed-off-by: Madhura Jayaratne --- ChangeLog | 1 + libraries/mult_submits.inc.php | 6 ++++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 8bab614e0b..a8d1562b31 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,7 @@ phpMyAdmin - ChangeLog - bug #4578 [security] XSS vulnerability in table print view - bug #4579 [security] XSS vulnerability in zoom search page - bug #4594 [security] Path traversal in file inclusion of GIS factory +- bug #4598 [security] XSS in multi submit 4.0.10.5 (2014-10-21) - bug #4562 [security] XSS in debug SQL output diff --git a/libraries/mult_submits.inc.php b/libraries/mult_submits.inc.php index aa71267223..147f55f0cc 100644 --- a/libraries/mult_submits.inc.php +++ b/libraries/mult_submits.inc.php @@ -170,12 +170,14 @@ if (!empty($submit_mult) && !empty($what)) { foreach ($selected AS $idx => $sval) { switch ($what) { case 'row_delete': - $full_query .= 'DELETE FROM ' . PMA_Util::backquote($db) . '.' . PMA_Util::backquote($table) + $full_query .= 'DELETE FROM ' + . PMA_Util::backquote(htmlspecialchars($db)) + . '.' . PMA_Util::backquote(htmlspecialchars($table)) // Do not append a "LIMIT 1" clause here // (it's not binlog friendly). // We don't need the clause because the calling panel permits // this feature only when there is a unique index. - . ' WHERE ' . urldecode($sval) + . ' WHERE ' . htmlspecialchars(urldecode($sval)) . ';
'; break; case 'drop_db':