CVE-2023-25727: XSS
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger Cross-site Scripting (XSS) by uploading a crafted .sql file through the drag-and-drop interface. By disabling the configuration directive $cfg['enabledragdropimport'], users will be unable to use the drag and drop upload which would protect against the vulnerability.
Other sources
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-25727?
The severity of CVE-2023-25727 is medium with a CVSS score of 5.4.
How can an attacker exploit CVE-2023-25727?
An attacker can exploit CVE-2023-25727 by uploading a crafted .sql file through the drag-and-drop interface in phpMyAdmin.
Which versions of phpMyAdmin are affected by CVE-2023-25727?
phpMyAdmin versions before 4.9.11 and 5.x before 5.2.1 are affected by CVE-2023-25727.
How can I fix CVE-2023-25727?
To fix CVE-2023-25727, update phpMyAdmin to version 4.9.11 or 5.2.1 or later.
Where can I find more information about CVE-2023-25727?
More information about CVE-2023-25727 can be found on the official phpMyAdmin website: https://www.phpmyadmin.net/security/PMASA-2023-1/