Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2015-2206: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Published: 2015-03-09T17:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/select_lang.lib.php
Commit date: 2015-03-04 12:34:43 -0500
Commit message: [security] Risk of BREACH attack

Thanks to Michal Čihař for the message suggestion.

Signed-off-by: Marc Delisle <marc@infomarc.info>

Diff: diff --git a/libraries/select_lang.lib.php b/libraries/select_lang.lib.php
index 2bd1a8d8f133..ab4c72554b7e 100644
--- a/libraries/select_lang.lib.php
+++ b/libraries/select_lang.lib.php
@@ -598,38 +598,18 @@ function PMA_langList()
 /* TCPDF translations */
 $GLOBALS['l']['w_page'] = __('Page number:');
 
 
 // now, that we have loaded the language strings we can send the errors
-if ($GLOBALS['lang_failed_cfg']) {
+if ($GLOBALS['lang_failed_cfg']
+    || $GLOBALS['lang_failed_cookie']
+    || $GLOBALS['lang_failed_request']) {
     trigger_error(
-        sprintf(
-            __('Unknown language: %1$s.'),
-            htmlspecialchars($GLOBALS['lang_failed_cfg'])
-        ),
+        __('Ignoring unsupported language code.'),
         E_USER_ERROR
     );
 }
-if ($GLOBALS['lang_failed_cookie']) {
-    trigger_error(
-        sprintf(
-            __('Unknown language: %1$s.'),
-            htmlspecialchars($GLOBALS['lang_failed_cookie'])
-        ),
-        E_USER_ERROR
-    );
-}
-if ($GLOBALS['lang_failed_request']) {
-    trigger_error(
-        sprintf(
-            __('Unknown language: %1$s.'),
-            htmlspecialchars($GLOBALS['lang_failed_request'])
-        ),
-        E_USER_ERROR
-    );
-}
-
 unset(
     $line, $fall_back_lang, $GLOBALS['lang_failed_cfg'],
     $GLOBALS['lang_failed_cookie'], $GLOBALS['lang_failed_request']
 );
 ?>

Vulnerable code: if ($GLOBALS['lang_failed_cfg']) {
        sprintf(
            __('Unknown language: %1$s.'),
            htmlspecialchars($GLOBALS['lang_failed_cfg'])
        ),
if ($GLOBALS['lang_failed_cookie']) {
    trigger_error(
        sprintf(
            __('Unknown language: %1$s.'),
            htmlspecialchars($GLOBALS['lang_failed_cookie'])
        ),
        E_USER_ERROR
    );
}
if ($GLOBALS['lang_failed_request']) {
    trigger_error(
        sprintf(
            __('Unknown language: %1$s.'),
            htmlspecialchars($GLOBALS['lang_failed_request'])
        ),
        E_USER_ERROR
    );
}

Fixed code: if ($GLOBALS['lang_failed_cfg']
    || $GLOBALS['lang_failed_cookie']
    || $GLOBALS['lang_failed_request']) {
        __('Ignoring unsupported language code.'),
CVE-2015-3903: Cryptographic Issues (CWE-310)
value: libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CWE description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Published: 2015-05-26T15:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, libraries/Config.class.php
Commit date: 2015-05-13 07:37:54 +0530
Commit message: bug #4900 [security] Vulnerability allowing man-in-the-middle attack

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>

Diff: diff --git a/ChangeLog b/ChangeLog
index b07e196832dd..3c3c8be499af 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,10 +1,11 @@
 phpMyAdmin - ChangeLog
 ======================
 
 4.4.6.1 (Not yet released)
 - bug #4899 [security] CSRF vulnerability in setup
+- bug #4900 [security] Vulnerability allowing man-in-the-middle attack
 
 4.4.6.0 (2015-05-07)
 - bug #4890 webkitStorageInfo and webkitIndexedDB is deprecated
 - bug #4892 Undefined variable: unique_conditions
 - bug #4891 CSV Import ignores "Replace table data with file" checkbox
diff --git a/libraries/Config.class.php b/libraries/Config.class.php
index 719312dc3294..bd7ff04a44ee 100644
--- a/libraries/Config.class.php
+++ b/libraries/Config.class.php
@@ -753,12 +753,10 @@ function checkHTTP($link, $get_body = false)
         }
         $ch = curl_init($link);
         curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
         curl_setopt($ch, CURLOPT_HEADER, 1);
         curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
-        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
-        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
         curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
         curl_setopt($ch, CURLOPT_USERAGENT, 'phpMyAdmin/' . PMA_VERSION);
         curl_setopt($ch, CURLOPT_TIMEOUT, 5);
         if (! defined('TESTSUITE')) {
             session_write_close();

Vulnerable code:         curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
Fixed code: - bug #4900 [security] Vulnerability allowing man-in-the-middle attack
CVE-2015-7873: 7PK - Security Features (CWE-254)
value: The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
CWE description: Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Published: 2015-10-28T10:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, url.php
Commit date: 2015-10-23 06:50:04 -0400
Commit message: Port content spoofing fix

Signed-off-by: Marc Delisle <marc@infomarc.info>

Diff: diff --git a/ChangeLog b/ChangeLog
index d0bd66a90e91b..e4eac27cc089b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -140,10 +140,14 @@ phpMyAdmin - ChangeLog
 - issue #11442 MySQL 5.7 and SHOW VARIABLES
 - issue #11445 MySQL 5.7 and Status page for an unprivileged user
 - issue #11448 Clarify doc about the MemoryLimit directive
 - issue #11489 Cannot copy a database under certain conditions
 
+4.4.15.1 (2015-10-23)
+- issue #11464 phpMyAdmin suggests upgrading to newer version not usable on that system
+- issue        [security] Content spoofing on url.php
+
 4.4.15.0 (2015-09-20)
 - issue #11411 Undefined "replace" function on numeric scalar
 - issue #11421 Stored-proc / routine - broken parameter parsing
 - issue        Missing name for configuration read_as_multibytes
 - issue #11431 Incorrect "No row selected" message
diff --git a/url.php b/url.php
index eec78a52b1b4c..9c4c8846b6f69 100644
--- a/url.php
+++ b/url.php
@@ -30,8 +30,9 @@
             window.onload=function(){
                 window.location='" . PMA_escapeJsString($_REQUEST['url']) . "';
             }
         </script>";
     // Display redirecting msg on screen.
-    printf(__('Taking you to %s.'), htmlspecialchars($_REQUEST['url']));
+    // Do not display the value of $_REQUEST['url'] to avoid showing injected content
+    echo __('Taking you to the target site.');
 }
 die();

Vulnerable code:     printf(__('Taking you to %s.'), htmlspecialchars($_REQUEST['url']));
Fixed code: 4.4.15.1 (2015-10-23)
- issue #11464 phpMyAdmin suggests upgrading to newer version not usable on that system
- issue        [security] Content spoofing on url.php

    // Do not display the value of $_REQUEST['url'] to avoid showing injected content
    echo __('Taking you to the target site.');
CVE-2016-2038: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2016-02-20T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/DatabaseInterface.class.php
Commit date: 2016-01-26 15:00:19 +0100
Commit message: Fallback to default collation connection

If user supplied wrong string we should gracefully fallback.

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/libraries/DatabaseInterface.class.php b/libraries/DatabaseInterface.class.php
index 7af15599cdc23..6678fcc2a32f2 100644
--- a/libraries/DatabaseInterface.class.php
+++ b/libraries/DatabaseInterface.class.php
@@ -1810,17 +1810,30 @@ public function postConnect($link)
                     $GLOBALS['collation_connection'] = 'utf8mb4_' . substr(
                         $GLOBALS['collation_connection'],
                         5
                     );
                 }
-                $this->query(
+                $result = $this->tryQuery(
                     "SET collation_connection = '"
                     . PMA_Util::sqlAddSlashes($GLOBALS['collation_connection'])
                     . "';",
                     $link,
                     self::QUERY_STORE
                 );
+                if ($result === false) {
+                    trigger_error(
+                        __('Failed to set configured collation connection!'),
+                        E_USER_WARNING
+                    );
+                    $this->query(
+                        "SET collation_connection = '"
+                        . PMA_Util::sqlAddSlashes($default_collation)
+                        . "';",
+                        $link,
+                        self::QUERY_STORE
+                    );
+                }
             } else {
                 $this->query(
                     "SET NAMES '$default_charset' COLLATE '$default_collation';",
                     $link,
                     self::QUERY_STORE

Vulnerable code:                 $this->query(
Fixed code:                 $result = $this->tryQuery(
                if ($result === false) {
                    trigger_error(
                        __('Failed to set configured collation connection!'),
                        E_USER_WARNING
                    );
                    $this->query(
                        "SET collation_connection = '"
                        . PMA_Util::sqlAddSlashes($default_collation)
                        . "';",
                        $link,
                        self::QUERY_STORE
                    );
                }
CVE-2016-2038: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2016-02-20T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: setup/lib/common.inc.php
Commit date: 2016-01-26 14:30:57 +0100
Commit message: Can not use PMA_fatalError when including fails

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/setup/lib/common.inc.php b/setup/lib/common.inc.php
index 8f64f1136bd9a..b2bde37e0f8f5 100644
--- a/setup/lib/common.inc.php
+++ b/setup/lib/common.inc.php
@@ -13,11 +13,11 @@
 define('PMA_MINIMUM_COMMON', true);
 define('PMA_SETUP', true);
 chdir('..');
 
 if (!file_exists('./libraries/common.inc.php')) {
-    PMA_fatalError('Bad invocation!');
+    die('Bad invocation!');
 }
 
 require_once './libraries/common.inc.php';
 require_once './libraries/Util.class.php';
 require_once './libraries/config/config_functions.lib.php';

Vulnerable code:     PMA_fatalError('Bad invocation!');
Fixed code:     die('Bad invocation!');
CVE-2016-5705: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an "invalid JSON" error message in the error console, (3) a database name in the central columns implementation, (4) a group name, or (5) a search name in the bookmarks implementation.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/server_privileges.lib.php
Commit date: 2016-06-22 10:53:46 +0200
Commit message: Escape user group when displaying

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/libraries/server_privileges.lib.php b/libraries/server_privileges.lib.php
index e15404522b9bf..6cda1f0a016bc 100644
--- a/libraries/server_privileges.lib.php
+++ b/libraries/server_privileges.lib.php
@@ -3677,11 +3677,11 @@ function PMA_getHtmlTableBodyForUserRights($db_rights)
                 . '' . implode(',' . "\n" . '            ', $host['privs']) . "\n"
                 . '</code></td>' . "\n";
             if ($cfgRelation['menuswork']) {
                 $html_output .= '<td class="usrGroup">' . "\n"
                     . (isset($group_assignment[$host['User']])
-                        ? $group_assignment[$host['User']]
+                        ? htmlspecialchars($group_assignment[$host['User']])
                         : ''
                     )
                     . '</td>' . "\n";
             }
             $html_output .= '<td>'

Vulnerable code:                         ? $group_assignment[$host['User']]
Fixed code:                         ? htmlspecialchars($group_assignment[$host['User']])
CVE-2016-5705: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an "invalid JSON" error message in the error console, (3) a database name in the central columns implementation, (4) a group name, or (5) a search name in the bookmarks implementation.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: JavaScript
Files changed: js/console.js
Commit date: 2016-06-20 10:11:25 +0200
Commit message: Escape error message from server

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/js/console.js b/js/console.js
index 802e8e1f4c990..79aedb448eb3b 100644
--- a/js/console.js
+++ b/js/console.js
@@ -199,11 +199,11 @@ var PMA_console = {
                     var data = $.parseJSON(xhr.responseText);
                     PMA_console.ajaxCallback(data);
                 } catch (e) {
                     console.log("Invalid JSON!" + e.message);
                     if (AJAX.xhr && AJAX.xhr.status === 0 && AJAX.xhr.statusText !== 'abort') {
-                        PMA_ajaxShowMessage($('<div />',{'class':'error','html':PMA_messages.strRequestFailed+' ( '+AJAX.xhr.statusText+' )'}));
+                        PMA_ajaxShowMessage($('<div />',{'class':'error','html':PMA_messages.strRequestFailed+' ( '+escapeHtml(AJAX.xhr.statusText)+' )'}));
                         AJAX.active = false;
                         AJAX.xhr = null;
                     }
                 }
             });

Vulnerable code:                         PMA_ajaxShowMessage($('<div />',{'class':'error','html':PMA_messages.strRequestFailed+' ( '+AJAX.xhr.statusText+' )'}));
Fixed code:                         PMA_ajaxShowMessage($('<div />',{'class':'error','html':PMA_messages.strRequestFailed+' ( '+escapeHtml(AJAX.xhr.statusText)+' )'}));
CVE-2016-5705: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an "invalid JSON" error message in the error console, (3) a database name in the central columns implementation, (4) a group name, or (5) a search name in the bookmarks implementation.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: JavaScript
Files changed: js/functions.js
Commit date: 2016-06-22 11:14:57 +0200
Commit message: Escape database name when showing dialog

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/js/functions.js b/js/functions.js
index fc5c8abe35703..3e36249f08099 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -3532,11 +3532,11 @@ AJAX.registerOnload('functions.js', function () {
             fields += '</tr>';
         }
         var result_pointer = i;
         var search_in = '<input type="text" class="filter_rows" placeholder="' + PMA_messages.searchList + '">';
         if (fields === '') {
-            fields = PMA_sprintf(PMA_messages.strEmptyCentralList, "'" + db + "'");
+            fields = PMA_sprintf(PMA_messages.strEmptyCentralList, "'" + escapeHtml(db) + "'");
             search_in = '';
         }
         var seeMore = '';
         if (list_size > maxRows) {
             seeMore = "<fieldset class='tblFooters' style='text-align:center;font-weight:bold'>" +

Vulnerable code:             fields = PMA_sprintf(PMA_messages.strEmptyCentralList, "'" + db + "'");
Fixed code:             fields = PMA_sprintf(PMA_messages.strEmptyCentralList, "'" + escapeHtml(db) + "'");
CVE-2016-5706: Resource Management Errors (CWE-399)
value: js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter.
CWE description: Weaknesses in this category are related to improper management of system resources.
CVSS v3 base score: 7.5
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: js/get_scripts.js.php
Commit date: 2016-06-15 18:07:12 +0200
Commit message: Limit number of included scripts in get_scripts.js.php

This avoids potential DOS, the limit is same as we use for generating
the URLs.

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/js/get_scripts.js.php b/js/get_scripts.js.php
index 8e828c91cc92e..06705c5d4ea03 100644
--- a/js/get_scripts.js.php
+++ b/js/get_scripts.js.php
@@ -34,11 +34,12 @@ function () {
     }
 );
 
 $_GET['scripts'] = json_decode($_GET['scripts']);
 if (! empty($_GET['scripts']) && is_array($_GET['scripts'])) {
-    foreach ($_GET['scripts'] as $script) {
+    // Only up to 10 scripts as this is what we generate
+    foreach (array_slice($_GET['scripts'], 0, 10) as $script) {
         // Sanitise filename
         $script_name = 'js';
 
         $path = explode("/", $script);
         foreach ($path as $index => $filename) {

Vulnerable code:     foreach ($_GET['scripts'] as $script) {
Fixed code:     // Only up to 10 scripts as this is what we generate
    foreach (array_slice($_GET['scripts'], 0, 10) as $script) {
CVE-2016-5730: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: examples/openid.php
Commit date: 2016-06-17 14:26:59 +0200
Commit message: Improve error handling in OpenID example

- properly check parameter types
- catch all exceptions (eg. network error)

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/examples/openid.php b/examples/openid.php
index da4a13fb531de..ab7707f5382cd 100644
--- a/examples/openid.php
+++ b/examples/openid.php
@@ -96,22 +96,22 @@ function Show_page($contents)
     Show_page($content);
     exit;
 }
 
 /* Grab identifier */
-if (isset($_POST['identifier'])) {
+if (isset($_POST['identifier']) && is_string($_POST['identifier'])) {
     $identifier = $_POST['identifier'];
-} else if (isset($_SESSION['identifier'])) {
+} else if (isset($_SESSION['identifier']) && is_string($_SESSION['identifier'])) {
     $identifier = $_SESSION['identifier'];
 } else {
     $identifier = null;
 }
 
 /* Create OpenID object */
 try {
     $o = new OpenID_RelyingParty($returnTo, $realm, $identifier);
-} catch (OpenID_Exception $e) {
+} catch (Exception $e) {
     $contents = "<div class='relyingparty_results'>\n";
     $contents .= "<pre>" . $e->getMessage() . "</pre>\n";
     $contents .= "</div class='relyingparty_results'>";
     Show_page($contents);
     exit;

Vulnerable code: if (isset($_POST['identifier'])) {
} else if (isset($_SESSION['identifier'])) {
} catch (OpenID_Exception $e) {
Fixed code: if (isset($_POST['identifier']) && is_string($_POST['identifier'])) {
} else if (isset($_SESSION['identifier']) && is_string($_SESSION['identifier'])) {
} catch (Exception $e) {
CVE-2016-5730: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: setup/validate.php
Commit date: 2016-06-17 09:35:57 +0200
Commit message: Fix error reporting on invalid request data

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/setup/validate.php b/setup/validate.php
index 893e0b70fef2f..c53c0e73b1e2d 100644
--- a/setup/validate.php
+++ b/setup/validate.php
@@ -24,8 +24,11 @@
     PMA_fatalError(__('Wrong data'));
 }
 $values = (array)$values;
 $result = PMA\libraries\config\Validator::validate($GLOBALS['ConfigFile'], $vids, $values, true);
 if ($result === false) {
-    $result = 'Wrong data or no validation for ' . $vids;
+    $result = sprintf(
+        __('Wrong data or no validation for %s'),
+        implode(',', $vids)
+    );
 }
 echo $result !== true ? json_encode($result) : '';

Vulnerable code:     $result = 'Wrong data or no validation for ' . $vids;
Fixed code:     $result = sprintf(
        __('Wrong data or no validation for %s'),
        implode(',', $vids)
    );
CVE-2016-5731: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: examples/openid.php
Commit date: 2016-06-17 14:30:36 +0200
Commit message: Escape error messages from OpenID

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/examples/openid.php b/examples/openid.php
index ab7707f5382cd..a15189b37af99 100644
--- a/examples/openid.php
+++ b/examples/openid.php
@@ -109,23 +109,23 @@ function Show_page($contents)
 /* Create OpenID object */
 try {
     $o = new OpenID_RelyingParty($returnTo, $realm, $identifier);
 } catch (Exception $e) {
     $contents = "<div class='relyingparty_results'>\n";
-    $contents .= "<pre>" . $e->getMessage() . "</pre>\n";
+    $contents .= "<pre>" . htmlspecialchars($e->getMessage()) . "</pre>\n";
     $contents .= "</div class='relyingparty_results'>";
     Show_page($contents);
     exit;
 }
 
 /* Redirect to OpenID provider */
 if (isset($_POST['start'])) {
     try {
         $authRequest = $o->prepare();
-    } catch (OpenID_Exception $e) {
+    } catch (Exception $e) {
         $contents = "<div class='relyingparty_results'>\n";
-        $contents .= "<pre>" . $e->getMessage() . "</pre>\n";
+        $contents .= "<pre>" . htmlspecialchars($e->getMessage()) . "</pre>\n";
         $contents .= "</div class='relyingparty_results'>";
         Show_page($contents);
         exit;
     }
 

Vulnerable code:     $contents .= "<pre>" . $e->getMessage() . "</pre>\n";
    } catch (OpenID_Exception $e) {
        $contents .= "<pre>" . $e->getMessage() . "</pre>\n";
Fixed code:     $contents .= "<pre>" . htmlspecialchars($e->getMessage()) . "</pre>\n";
    } catch (Exception $e) {
        $contents .= "<pre>" . htmlspecialchars($e->getMessage()) . "</pre>\n";
CVE-2016-5732: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: templates/table/structure/display_partitions.phtml
Commit date: 2016-06-17 14:37:37 +0200
Commit message: Add missing escaping to partition listing

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/templates/table/structure/display_partitions.phtml b/templates/table/structure/display_partitions.phtml
index fd5b82d273925..2afdb4d98b9bc 100644
--- a/templates/table/structure/display_partitions.phtml
+++ b/templates/table/structure/display_partitions.phtml
@@ -8,16 +8,16 @@ use PMA\libraries\Util; ?>
         <?php if (empty($partitions)): ?>
             <?= Message::notice(__('No partitioning defined!'))->getDisplay(); ?>
         <?php else: ?>
             <p>
                 <?= __('Partitioned by:');?>
-                <code><?= $partitionMethod , '(' , $partitionExpression , ' )'; ?></code>
+                <code><?= htmlspecialchars($partitionMethod) , '(' , htmlspecialchars($partitionExpression) , ' )'; ?></code>
             </p>
             <?php if ($hasSubPartitions): ?>
                 <p>
                     <?= __('Sub partitioned by:'); ?>
-                    <code><?= $subPartitionMethod , '(' , $subPartitionExpression , ' )'; ?></code>
+                    <code><?= htmlspecialchars($subPartitionMethod) , '(' , htmlspecialchars($subPartitionExpression) , ' )'; ?></code>
                 <p>
             <?php endif; ?>
             <table>
                 <thead>
                     <tr>
@@ -137,6 +137,6 @@ use PMA\libraries\Util; ?>
                 <?= Util::linkOrButton($removeUrl, __('Remove partitioning'), ['class' => 'button ajax', 'id' => 'remove_partitioning'])?>
                 <input type="submit" name="edit_partitioning" value="<?= __('Edit partitioning'); ?>" />
             <?php endif; ?>
         </form>
     </fieldset>
-</div>
\ No newline at end of file
+</div>

Vulnerable code:                 <code><?= $partitionMethod , '(' , $partitionExpression , ' )'; ?></code>
                    <code><?= $subPartitionMethod , '(' , $subPartitionExpression , ' )'; ?></code>
</div>
Fixed code:                 <code><?= htmlspecialchars($partitionMethod) , '(' , htmlspecialchars($partitionExpression) , ' )'; ?></code>
                    <code><?= htmlspecialchars($subPartitionMethod) , '(' , htmlspecialchars($subPartitionExpression) , ' )'; ?></code>
</div>
CVE-2016-5732: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: templates/table/structure/display_partitions.phtml
Commit date: 2016-06-22 10:26:50 +0200
Commit message: Escape partition comment when displaying

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/templates/table/structure/display_partitions.phtml b/templates/table/structure/display_partitions.phtml
index 2afdb4d98b9bc..41908266cb865 100644
--- a/templates/table/structure/display_partitions.phtml
+++ b/templates/table/structure/display_partitions.phtml
@@ -72,11 +72,11 @@ use PMA\libraries\Util; ?>
                             );
                             ?>
                             <span><?= $value; ?></span>
                             <span class="unit"><?= $unit; ?></span>
                         </td>
-                        <td><?= $partition->getComment(); ?></td>
+                        <td><?= htmlspecialchars($partition->getComment()); ?></td>
                         <?php foreach ($actionIcons as $action => $icon): ?>
                             <td>
                                 <a  href="tbl_structure.php<?= $url_query; ?>&amp;partition_maintenance=1&amp;sql_query=<?= urlencode(
                                         "ALTER TABLE " . Util::backquote($table) . $action . " PARTITION " . $partition->getName()
                                     ) ?>"

Vulnerable code:                         <td><?= $partition->getComment(); ?></td>
Fixed code:                         <td><?= htmlspecialchars($partition->getComment()); ?></td>
CVE-2016-5733: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: templates/server/binlog/log_selector.phtml
Commit date: 2016-06-17 14:51:15 +0200
Commit message: Escape binary log name

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/templates/server/binlog/log_selector.phtml b/templates/server/binlog/log_selector.phtml
index 32012399e27f5..0f8ad9edca67c 100644
--- a/templates/server/binlog/log_selector.phtml
+++ b/templates/server/binlog/log_selector.phtml
@@ -5,12 +5,12 @@
             <?= __('Select binary log to view'); ?>
         </legend>
         <?php $full_size = 0; ?>
         <select name="log">
             <?php foreach ($binary_logs as $each_log): ?>
-                <option value="<?= $each_log['Log_name']; ?>"<?= ($each_log['Log_name'] == $_REQUEST['log'] ? ' selected="selected"' : ''); ?>>
-                    <?= $each_log['Log_name']; ?>
+                <option value="<?= htmlspecialchars($each_log['Log_name']); ?>"<?= ($each_log['Log_name'] == $_REQUEST['log'] ? ' selected="selected"' : ''); ?>>
+                    <?= htmlspecialchars($each_log['Log_name']); ?>
                     <?php if (isset($each_log['File_size'])): ?>
                         (<?= implode(' ', \PMA\libraries\Util::formatByteDown($each_log['File_size'], 3, 2)); ?>)
                         <?php $full_size += $each_log['File_size']; ?>
                     <?php endif; ?>
                 </option>
@@ -22,6 +22,6 @@
         <?php endif; ?>
     </fieldset>
     <fieldset class="tblFooters">
         <input type="submit" value="<?= __('Go'); ?>" />
     </fieldset>
-</form>
\ No newline at end of file
+</form>

Vulnerable code:                 <option value="<?= $each_log['Log_name']; ?>"<?= ($each_log['Log_name'] == $_REQUEST['log'] ? ' selected="selected"' : ''); ?>>
                    <?= $each_log['Log_name']; ?>
</form>
Fixed code:                 <option value="<?= htmlspecialchars($each_log['Log_name']); ?>"<?= ($each_log['Log_name'] == $_REQUEST['log'] ? ' selected="selected"' : ''); ?>>
                    <?= htmlspecialchars($each_log['Log_name']); ?>
</form>
CVE-2016-5733: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: JavaScript
Files changed: js/tbl_chart.js
Commit date: 2016-06-22 13:07:32 +0200
Commit message: Fixed rendering of chart of columns with HTML inside

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/js/tbl_chart.js b/js/tbl_chart.js
index eb8730c78b651..41ff296436bd8 100644
--- a/js/tbl_chart.js
+++ b/js/tbl_chart.js
@@ -154,11 +154,11 @@ function drawChart() {
         currentChart.destroy();
     }
 
     var columnNames = [];
     $('select[name="chartXAxis"] option').each(function () {
-        columnNames.push($(this).text());
+        columnNames.push(escapeHtml($(this).text()));
     });
     try {
         currentChart = PMA_queryChart(chart_data, columnNames, currentSettings);
         if (currentChart != null) {
             $('#saveChart').attr('href', currentChart.toImageString());

Vulnerable code:         columnNames.push($(this).text());
Fixed code:         columnNames.push(escapeHtml($(this).text()));
CVE-2016-5733: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: templates/table/search/rows_zoom.phtml
Commit date: 2016-06-22 11:10:14 +0200
Commit message: Properly escape zoom search column type

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/templates/table/search/rows_zoom.phtml b/templates/table/search/rows_zoom.phtml
index 0dcb712a040e6..a3f393a651980 100644
--- a/templates/table/search/rows_zoom.phtml
+++ b/templates/table/search/rows_zoom.phtml
@@ -76,11 +76,11 @@ for ($i = 0; $i < 4; $i++): ?>
         <td>
             <input type="hidden"
                    name="criteriaColumnTypes[<?= $i; ?>]"
                    id="types_<?= $i; ?>"
                 <?php if (isset($_POST['criteriaColumnTypes'][$i])): ?>
-                    value="<?= $_POST['criteriaColumnTypes'][$i]; ?>"
+                    value="<?= htmlspecialchars($_POST['criteriaColumnTypes'][$i]); ?>"
                 <?php endif; ?> />
             <input type="hidden"
                    name="criteriaColumnCollations[<?= $i; ?>]"
                    id="collations_<?= $i; ?>" />
         </td>

Vulnerable code:                     value="<?= $_POST['criteriaColumnTypes'][$i]; ?>"
Fixed code:                     value="<?= htmlspecialchars($_POST['criteriaColumnTypes'][$i]); ?>"
CVE-2016-5733: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: templates/server/databases/table_row.phtml
Commit date: 2016-06-17 14:45:29 +0200
Commit message: Properly escape translated string

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/templates/server/databases/table_row.phtml b/templates/server/databases/table_row.phtml
index 20284f8f048ec..20259f4862716 100644
--- a/templates/server/databases/table_row.phtml
+++ b/templates/server/databases/table_row.phtml
@@ -56,10 +56,10 @@
     <?php endif; ?>
 
     <td class="tool">
         <a onclick="PMA_commonActions.setDb('<?= PMA_jsFormat($current['SCHEMA_NAME']) ?>');"
            href="server_privileges.php<?= $url_query; ?>&amp;db=<?= urlencode($current['SCHEMA_NAME']); ?>&amp;checkprivsdb=<?= urlencode($current['SCHEMA_NAME']); ?>"
-           title="<?= sprintf(__('Check privileges for database "%s".'), htmlspecialchars($current['SCHEMA_NAME'])); ?>">
+           title="<?= htmlspecialchars(sprintf(__('Check privileges for database "%s".'), $current['SCHEMA_NAME'])); ?>">
            <?= \PMA\libraries\Util::getIcon('s_rights.png', __('Check privileges')); ?>
         </a>
     </td>
-</tr>
\ No newline at end of file
+</tr>

Vulnerable code:            title="<?= sprintf(__('Check privileges for database "%s".'), htmlspecialchars($current['SCHEMA_NAME'])); ?>">
</tr>
Fixed code:            title="<?= htmlspecialchars(sprintf(__('Check privileges for database "%s".'), $current['SCHEMA_NAME'])); ?>">
</tr>
CVE-2016-5733: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: JavaScript
Files changed: js/ajax.js
Commit date: 2016-06-20 10:07:52 +0200
Commit message: Escape HTML when rendering AJAX error

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/js/ajax.js b/js/ajax.js
index ba121c81a847e..bac829d9f0930 100644
--- a/js/ajax.js
+++ b/js/ajax.js
@@ -785,12 +785,12 @@ $(document).ajaxError(function (event, request, settings) {
         var errorCode = PMA_sprintf(PMA_messages.strErrorCode, request.status);
         var errorText = PMA_sprintf(PMA_messages.strErrorText, request.statusText);
         PMA_ajaxShowMessage(
             '<div class="error">' +
             PMA_messages.strErrorProcessingRequest +
-            '<div>' + errorCode + '</div>' +
-            '<div>' + errorText + '</div>' +
+            '<div>' + escapeHtml(errorCode) + '</div>' +
+            '<div>' + escapeHtml(errorText) + '</div>' +
             '</div>',
             false
         );
         AJAX.active = false;
     }

Vulnerable code:             '<div>' + errorCode + '</div>' +
            '<div>' + errorText + '</div>' +
Fixed code:             '<div>' + escapeHtml(errorCode) + '</div>' +
            '<div>' + escapeHtml(errorText) + '</div>' +
CVE-2016-5733: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: js/get_image.js.php
Commit date: 2016-06-20 10:04:16 +0200
Commit message: Escape attributes when showing images in javascript

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/js/get_image.js.php b/js/get_image.js.php
index 7a76a6d1dbadc..0c475d79d06c3 100644
--- a/js/get_image.js.php
+++ b/js/get_image.js.php
@@ -107,19 +107,19 @@ function PMA_getImage(image, alternate, attributes) {
     if (alternate == undefined) {
         alternate = '';
     }
     // set alt
     if (attributes.alt != undefined) {
-        retval.attr('alt', attributes.alt);
+        retval.attr('alt', escapeHtml(attributes.alt));
     } else {
-        retval.attr('alt', alternate);
+        retval.attr('alt', escapeHtml(alternate));
     }
     // set title
     if (attributes.title != undefined) {
-        retval.attr('title', attributes.title);
+        retval.attr('title', escapeHtml(attributes.title));
     } else {
-        retval.attr('title', alternate);
+        retval.attr('title', escapeHtml(alternate));
     }
     // set src
     var klass = image.replace('.gif', '').replace('.png', '');
     if (in_array(klass, sprites)) {
         // it's an icon from a sprite

Vulnerable code:         retval.attr('alt', attributes.alt);
        retval.attr('alt', alternate);
        retval.attr('title', attributes.title);
        retval.attr('title', alternate);
Fixed code:         retval.attr('alt', escapeHtml(attributes.alt));
        retval.attr('alt', escapeHtml(alternate));
        retval.attr('title', escapeHtml(attributes.title));
        retval.attr('title', escapeHtml(alternate));