CVE-2023-25727: Cross-site Scripting vulnerability in drag-and-drop upload of phpMyAdmin
Cross-site Scripting vulnerability in drag-and-drop upload of phpMyAdmin
Other sources
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger Cross-site Scripting (XSS) by uploading a crafted .sql file through the drag-and-drop interface. By disabling the configuration directive $cfg['enabledragdropimport'], users will be unable to use the drag and drop upload which would protect against the vulnerability.
— GitHub
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpmyadmin/phpmyadminto a version that resolves this vulnerability.Fixed in 5.2.1 - Upgrade
Upgrade
composer/phpmyadmin/phpmyadminto a version that resolves this vulnerability.Fixed in 4.9.11 - Upgrade
Upgrade
phpMyAdminto a version that resolves this vulnerability.Fixed in 4.9.11 - Upgrade
Upgrade
phpMyAdminto a version that resolves this vulnerability.Fixed in 5.2.1 - Configuration
Disable the $cfg['enable_drag_drop_import'] configuration directive to prevent use of drag-and-drop uploads.
phpMyAdmin $cfg['enable_drag_drop_import'] = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2023-25727?
The severity of CVE-2023-25727 is medium with a CVSS score of 5.4.
How can an attacker exploit CVE-2023-25727?
An attacker can exploit CVE-2023-25727 by uploading a crafted .sql file through the drag-and-drop interface in phpMyAdmin.
Which versions of phpMyAdmin are affected by CVE-2023-25727?
phpMyAdmin versions before 4.9.11 and 5.x before 5.2.1 are affected by CVE-2023-25727.
How can I fix CVE-2023-25727?
To fix CVE-2023-25727, update phpMyAdmin to version 4.9.11 or 5.2.1 or later.
Where can I find more information about CVE-2023-25727?
More information about CVE-2023-25727 can be found on the official phpMyAdmin website: https://www.phpmyadmin.net/security/PMASA-2023-1/