CVE-2014-4348: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name that is improperly handled after presence in (a) the favorite list or (b) recent tables.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-06-25T11:19Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/RecentFavoriteTable.class.php, libraries/structure.lib.php
Commit date: 2014-06-06 18:40:19 +0200
Commit message: Fix XSS in recent/favorite tables list feature

Signed-off-by: Ann + J.M <phpMyAdmin@ZweiSteinSoft.de>

Diff: diff --git a/libraries/RecentFavoriteTable.class.php b/libraries/RecentFavoriteTable.class.php
index 54041c51a380..84aed2098838 100644
--- a/libraries/RecentFavoriteTable.class.php
+++ b/libraries/RecentFavoriteTable.class.php
@@ -204,12 +204,13 @@ public function getHtmlList()
                 foreach ($this->_tables as $table) {
                     $html .= '<li class="warp_link">';
                     $html .= '<a href="sql.php?server=' . $GLOBALS['server']
                           . '&db=' . $table['db']
                           . '&table=' . $table['table']
-                          . '&token=' . $_SESSION[' PMA_token ']
-                          . '">`' . $table['db'] . '`.`' . $table['table'] . '`</a>';
+                          . '&token=' . $_SESSION[' PMA_token '] . '">`'
+                          . htmlspecialchars($table['db']) . '`.`'
+                          . htmlspecialchars($table['table']) . '`</a>';
                     $html .= '</li>';
                 }
             } else {
                 foreach ($this->_tables as $table) {
                     $html .= '<li class="warp_link">';
@@ -221,20 +222,22 @@ public function getHtmlList()
                         'remove_favorite' => true);
                     $fav_rm_url = 'db_structure.php'
                         . PMA_URL_getCommon($fav_params);
                     $html .= 'href="' . $fav_rm_url
                         . '" title="' . __("Remove from Favorites")
-                        . '" data-favtargetn="' . $table['db'] . "." . $table['table']
+                        . '" data-favtargetn="'
+                        . md5($table['db'] . "." . $table['table'])
                         . '" >'
                         . PMA_Util::getIcon('b_favorite.png')
                         . '</a>';
 
                     $html .= '<a href="sql.php?server=' . $GLOBALS['server']
                           . '&db=' . $table['db']
                           . '&table=' . $table['table']
-                          . '&token=' . $_SESSION[' PMA_token ']
-                          . '">`' . $table['db'] . '`.`' . $table['table'] . '`</a>';
+                          . '&token=' . $_SESSION[' PMA_token '] . '">`'
+                          . htmlspecialchars($table['db']) . '`.`'
+                          . htmlspecialchars($table['table']) . '`</a>';
                     $html .= '</li>';
                 }
             }
         } else {
             $html .= '<li class="warp_link">'
diff --git a/libraries/structure.lib.php b/libraries/structure.lib.php
index 5e32c6935ee5..db5777184f2d 100644
--- a/libraries/structure.lib.php
+++ b/libraries/structure.lib.php
@@ -2734,27 +2734,28 @@ function PMA_checkFavoriteTable($db, $current_table)
  * @return $html_output
  */
 function PMA_getHtmlForFavoriteAnchor($db, $current_table, $titles)
 {
     $html_output  = '<a ';
-    $html_output .= 'id="' . preg_replace(
-        '/\s+/', '', $current_table['TABLE_NAME']
-    ) . '_favorite_anchor" ';
+    $html_output .= 'id="' . md5($current_table['TABLE_NAME'])
+        . '_favorite_anchor" ';
     $html_output .= 'class="ajax favorite_table_anchor';
 
     // Check if current table is already in favorite list.
     $already_favorite = PMA_checkFavoriteTable($db, $current_table['TABLE_NAME']);
     $fav_params = array('db' => $db,
         'ajax_request' => true,
         'favorite_table' => $current_table['TABLE_NAME'],
-        (($already_favorite?'remove':'add') . '_favorite') => true);
+        (($already_favorite?'remove':'add') . '_favorite') => true
+    );
     $fav_url = 'db_structure.php' . PMA_URL_getCommon($fav_params);
     $html_output .= '" ';
     $html_output .= 'href="' . $fav_url
         . '" title="' . ($already_favorite ? __("Remove from Favorites")
         : __("Add to Favorites"))
-        . '" data-favtargets="' . $db . "." . $current_table['TABLE_NAME']
+        . '" data-favtargets="'
+        . md5($db . "." . $current_table['TABLE_NAME'])
         . '" >'
         . (!$already_favorite ? $titles['NoFavorite']
         : $titles['Favorite']) . '</a>';
 
     return $html_output;

Vulnerable code:                           . '&token=' . $_SESSION[' PMA_token ']
                          . '">`' . $table['db'] . '`.`' . $table['table'] . '`</a>';
                        . '" data-favtargetn="' . $table['db'] . "." . $table['table']
                          . '&token=' . $_SESSION[' PMA_token ']
                          . '">`' . $table['db'] . '`.`' . $table['table'] . '`</a>';
    $html_output .= 'id="' . preg_replace(
        '/\s+/', '', $current_table['TABLE_NAME']
    ) . '_favorite_anchor" ';
        (($already_favorite?'remove':'add') . '_favorite') => true);
        . '" data-favtargets="' . $db . "." . $current_table['TABLE_NAME']
Fixed code:                           . '&token=' . $_SESSION[' PMA_token '] . '">`'
                          . htmlspecialchars($table['db']) . '`.`'
                          . htmlspecialchars($table['table']) . '`</a>';
                        . '" data-favtargetn="'
                        . md5($table['db'] . "." . $table['table'])
                          . '&token=' . $_SESSION[' PMA_token '] . '">`'
                          . htmlspecialchars($table['db']) . '`.`'
                          . htmlspecialchars($table['table']) . '`</a>';
    $html_output .= 'id="' . md5($current_table['TABLE_NAME'])
        . '_favorite_anchor" ';
        (($already_favorite?'remove':'add') . '_favorite') => true
    );
        . '" data-favtargets="'
        . md5($db . "." . $current_table['TABLE_NAME'])