CVE-2012-5339: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-10-25T10:51Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: js/rte/common.js, libraries/rte/rte_list.lib.php
Commit date: 2012-10-04 21:41:22 +0530
Commit message: triggers, routines, events : escape drop sql

Diff: diff --git a/js/rte/common.js b/js/rte/common.js
index a1a553cdea7..b79987dda33 100644
--- a/js/rte/common.js
+++ b/js/rte/common.js
@@ -316,11 +316,11 @@ $(document).ready(function () {
          */
         var $curr_row = $(this).parents('tr');
         /**
          * @var question    String containing the question to be asked for confirmation
          */
-        var question = $('<div/>').text($curr_row.children('td').children('.drop_sql').html());
+        var question = $('<div/>').text($curr_row.children('td').children('.drop_sql').text());
         // We ask for confirmation first here, before submitting the ajax request
         $(this).PMA_confirm(question, $(this).attr('href'), function (url) {
             /**
              * @var    $msg    jQuery object containing the reference to
              *                 the AJAX message shown to the user.
diff --git a/libraries/rte/rte_list.lib.php b/libraries/rte/rte_list.lib.php
index 34556b4d254..e0bf2e9d487 100644
--- a/libraries/rte/rte_list.lib.php
+++ b/libraries/rte/rte_list.lib.php
@@ -119,11 +119,11 @@ function PMA_RTN_getRowForList($routine, $rowclass = '')
                          PMA_backquote($routine['SPECIFIC_NAME']));
     $type_link = "item_type={$routine['ROUTINE_TYPE']}";
 
     $retval  = "        <tr class='noclick $rowclass'>\n";
     $retval .= "            <td>\n";
-    $retval .= "                <span class='drop_sql hide'>$sql_drop</span>\n";
+    $retval .= "                <span class='drop_sql hide'>" . htmlspecialchars($sql_drop) . "</span>\n";
     $retval .= "                <strong>\n";
     $retval .= "                    " . htmlspecialchars($routine['SPECIFIC_NAME']) . "\n";
     $retval .= "                </strong>\n";
     $retval .= "            </td>\n";
     $retval .= "            <td>\n";
@@ -221,11 +221,11 @@ function PMA_TRI_getRowForList($trigger, $rowclass = '')
 {
     global $ajax_class, $url_query, $db, $table, $titles;
 
     $retval  = "        <tr class='noclick $rowclass'>\n";
     $retval .= "            <td>\n";
-    $retval .= "                <span class='drop_sql hide'>{$trigger['drop']}</span>\n";
+    $retval .= "                <span class='drop_sql hide'>" . htmlspecialchars($trigger['drop']) . "</span>\n";
     $retval .= "                <strong>\n";
     $retval .= "                    " . htmlspecialchars($trigger['name']) . "\n";
     $retval .= "                </strong>\n";
     $retval .= "            </td>\n";
     if (empty($table)) {
@@ -295,11 +295,11 @@ function PMA_EVN_getRowForList($event, $rowclass = '')
         PMA_backquote($event['EVENT_NAME'])
     );
 
     $retval  = "        <tr class='noclick $rowclass'>\n";
     $retval .= "            <td>\n";
-    $retval .= "                <span class='drop_sql hide'>$sql_drop</span>\n";
+    $retval .= "                <span class='drop_sql hide'>" . htmlspecialchars($sql_drop) . "</span>\n";
     $retval .= "                <strong>\n";
     $retval .= "                    " . htmlspecialchars($event['EVENT_NAME']) . "\n";
     $retval .= "                </strong>\n";
     $retval .= "            </td>\n";
     $retval .= "            <td>\n";

Vulnerable code:         var question = $('<div/>').text($curr_row.children('td').children('.drop_sql').html());
    $retval .= "                <span class='drop_sql hide'>$sql_drop</span>\n";
    $retval .= "                <span class='drop_sql hide'>{$trigger['drop']}</span>\n";
    $retval .= "                <span class='drop_sql hide'>$sql_drop</span>\n";
Fixed code:         var question = $('<div/>').text($curr_row.children('td').children('.drop_sql').text());
    $retval .= "                <span class='drop_sql hide'>" . htmlspecialchars($sql_drop) . "</span>\n";
    $retval .= "                <span class='drop_sql hide'>" . htmlspecialchars($trigger['drop']) . "</span>\n";
    $retval .= "                <span class='drop_sql hide'>" . htmlspecialchars($sql_drop) . "</span>\n";