CVE-2014-4955: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-07-20T11:12Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, libraries/rte/rte_list.lib.php
Commit date: 2014-07-11 06:39:20 -0400
Commit message: bug #4488 [security] XSS injection due to unescaped table name (triggers)

Signed-off-by: Marc Delisle <marc@infomarc.info>

Diff: diff --git a/ChangeLog b/ChangeLog
index 431379ee70f2..446230a68815 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -10,10 +10,11 @@ phpMyAdmin - ChangeLog
 - bug #4481 mult_submits.inc.php Undefined variable Error
 - bug #4485 Sorting breaks the copy column feature
 - bug #4440 Javascript error when renaming table
 - bug #4483 'New window' link (selflink) disappears, causing Javascript error
 - bug #4486 [security] XSS injection due to unescaped table comment
+- bug #4488 [security] XSS injection due to unescaped table name (triggers)
 
 4.2.5.0 (2014-06-26)
 - bug #4467 shell_exec() has been disabled for security reasons
 - bug #4470 Error while submitting empty query
 - bug #4463 Fatal error: Class 'PMA_DatabaseInterface' not found
diff --git a/libraries/rte/rte_list.lib.php b/libraries/rte/rte_list.lib.php
index e6d119bffd07..78a4fcaf3669 100644
--- a/libraries/rte/rte_list.lib.php
+++ b/libraries/rte/rte_list.lib.php
@@ -257,13 +257,13 @@ function PMA_TRI_getRowForList($trigger, $rowclass = '')
     $retval .= "                    " . htmlspecialchars($trigger['name']) . "\n";
     $retval .= "                </strong>\n";
     $retval .= "            </td>\n";
     if (empty($table)) {
         $retval .= "            <td>\n";
-        $retval .= "                <a href='db_triggers.php?{$url_query}"
-                                     . "&amp;table={$trigger['table']}'>"
-                                     . $trigger['table'] . "</a>\n";
+        $retval .= "<a href='db_triggers.php?{$url_query}"
+            . "&amp;table=" . urlencode($trigger['table']) . "'>"
+            . urlencode($trigger['table']) . "</a>";
         $retval .= "            </td>\n";
     }
     $retval .= "            <td>\n";
     if (PMA_Util::currentUserHasPrivilege('TRIGGER', $db, $table)) {
         $retval .= '                <a ' . $ajax_class['edit']

Vulnerable code:         $retval .= "                <a href='db_triggers.php?{$url_query}"
                                     . "&amp;table={$trigger['table']}'>"
                                     . $trigger['table'] . "</a>\n";
Fixed code: - bug #4488 [security] XSS injection due to unescaped table name (triggers)
        $retval .= "<a href='db_triggers.php?{$url_query}"
            . "&amp;table=" . urlencode($trigger['table']) . "'>"
            . urlencode($trigger['table']) . "</a>";