CVE-2012-5339: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-10-25T10:51Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/rte/rte_events.lib.php, libraries/rte/rte_routines.lib.php, libraries/rte/rte_triggers.lib.php
Commit date: 2012-10-03 20:22:25 +0200
Commit message: triggers, routines, events : escape sql queries in error messages

Diff: diff --git a/libraries/rte/rte_events.lib.php b/libraries/rte/rte_events.lib.php
index c8619a00000..41fd467395b 100644
--- a/libraries/rte/rte_events.lib.php
+++ b/libraries/rte/rte_events.lib.php
@@ -97,27 +97,40 @@ function PMA_EVN_handleEditor()
                     $_REQUEST['item_original_name']
                 );
                 $drop_item = "DROP EVENT " . PMA_backquote($_REQUEST['item_original_name']) . ";\n";
                 $result = PMA_DBI_try_query($drop_item);
                 if (! $result) {
-                    $errors[] = sprintf(__('The following query has failed: "%s"'), $drop_item) . '<br />'
-                                      . __('MySQL said: ') . PMA_DBI_getError(null);
+                    $errors[] = sprintf(
+                        __('The following query has failed: "%s"'),
+                        htmlspecialchars($drop_item)
+                    )
+                    . '<br />'
+                    . __('MySQL said: ') . PMA_DBI_getError(null);
                 } else {
                     $result = PMA_DBI_try_query($item_query);
                     if (! $result) {
-                        $errors[] = sprintf(__('The following query has failed: "%s"'), $item_query) . '<br />'
-                                          . __('MySQL said: ') . PMA_DBI_getError(null);
+                        $errors[] = sprintf(
+                            __('The following query has failed: "%s"'),
+                            htmlspecialchars($item_query)
+                        )
+                        . '<br />'
+                        . __('MySQL said: ') . PMA_DBI_getError(null);
                         // We dropped the old item, but were unable to create the new one
                         // Try to restore the backup query
                         $result = PMA_DBI_try_query($create_item);
                         if (! $result) {
                             // OMG, this is really bad! We dropped the query, failed to create a new one
                             // and now even the backup query does not execute!
                             // This should not happen, but we better handle this just in case.
-                            $errors[] = __('Sorry, we failed to restore the dropped event.') . '<br />'
-                                              . __('The backed up query was:') . "\"$create_item\"" . '<br />'
-                                              . __('MySQL said: ') . PMA_DBI_getError(null);
+                            $errors[] = __(
+                                'Sorry, we failed to restore the dropped event.'
+                            )
+                            . '<br />'
+                            . __('The backed up query was:')
+                            . "\"" . htmlspecialchars($create_item) . "\""
+                            . '<br />'
+                            . __('MySQL said: ') . PMA_DBI_getError(null);
                         }
                     } else {
                         $message = PMA_Message::success(__('Event %1$s has been modified.'));
                         $message->addParam(PMA_backquote($_REQUEST['item_name']));
                         $sql_query = $drop_item . $item_query;
@@ -125,12 +138,16 @@ function PMA_EVN_handleEditor()
                 }
             } else {
                 // 'Add a new item' mode
                 $result = PMA_DBI_try_query($item_query);
                 if (! $result) {
-                    $errors[] = sprintf(__('The following query has failed: "%s"'), $item_query) . '<br /><br />'
-                                      . __('MySQL said: ') . PMA_DBI_getError(null);
+                    $errors[] = sprintf(
+                        __('The following query has failed: "%s"'),
+                        htmlspecialchars($item_query)
+                    )
+                    . '<br /><br />'
+                    . __('MySQL said: ') . PMA_DBI_getError(null);
                 } else {
                     $message = PMA_Message::success(__('Event %1$s has been created.'));
                     $message->addParam(PMA_backquote($_REQUEST['item_name']));
                     $sql_query = $item_query;
                 }
diff --git a/libraries/rte/rte_routines.lib.php b/libraries/rte/rte_routines.lib.php
index 01652c2ee7f..414cbc2d70e 100644
--- a/libraries/rte/rte_routines.lib.php
+++ b/libraries/rte/rte_routines.lib.php
@@ -247,27 +247,40 @@ function PMA_RTN_handleEditor()
                     // Backup the old routine, in case something goes wrong
                     $create_routine = PMA_DBI_get_definition($db, $_REQUEST['item_original_type'], $_REQUEST['item_original_name']);
                     $drop_routine = "DROP {$_REQUEST['item_original_type']} " . PMA_backquote($_REQUEST['item_original_name']) . ";\n";
                     $result = PMA_DBI_try_query($drop_routine);
                     if (! $result) {
-                        $errors[] = sprintf(__('The following query has failed: "%s"'), $drop_routine) . '<br />'
-                                          . __('MySQL said: ') . PMA_DBI_getError(null);
+                        $errors[] = sprintf(
+                            __('The following query has failed: "%s"'),
+                            htmlspecialchars($drop_routine)
+                        )
+                        . '<br />'
+                        . __('MySQL said: ') . PMA_DBI_getError(null);
                     } else {
                         $result = PMA_DBI_try_query($routine_query);
                         if (! $result) {
-                            $errors[] = sprintf(__('The following query has failed: "%s"'), $routine_query) . '<br />'
-                                              . __('MySQL said: ') . PMA_DBI_getError(null);
+                            $errors[] = sprintf(
+                                __('The following query has failed: "%s"'),
+                                htmlspecialchars($routine_query)
+                            )
+                            . '<br />'
+                            . __('MySQL said: ') . PMA_DBI_getError(null);
                             // We dropped the old routine, but were unable to create the new one
                             // Try to restore the backup query
                             $result = PMA_DBI_try_query($create_routine);
                             if (! $result) {
                                 // OMG, this is really bad! We dropped the query, failed to create a new one
                                 // and now even the backup query does not execute!
                                 // This should not happen, but we better handle this just in case.
-                                $errors[] = __('Sorry, we failed to restore the dropped routine.') . '<br />'
-                                                  . __('The backed up query was:') . "\"$create_routine\"" . '<br />'
-                                                  . __('MySQL said: ') . PMA_DBI_getError(null);
+                                $errors[] = __(
+                                    'Sorry, we failed to restore the dropped routine.'
+                                )
+                                . '<br />'
+                                . __('The backed up query was:')
+                                . "\"" . htmlspecialchars($create_routine) . "\""
+                                . '<br />'
+                                . __('MySQL said: ') . PMA_DBI_getError(null);
                             }
                         } else {
                             $message = PMA_Message::success(__('Routine %1$s has been modified.'));
                             $message->addParam(PMA_backquote($_REQUEST['item_name']));
                             $sql_query = $drop_routine . $routine_query;
@@ -276,12 +289,16 @@ function PMA_RTN_handleEditor()
                 }
             } else {
                 // 'Add a new routine' mode
                 $result = PMA_DBI_try_query($routine_query);
                 if (! $result) {
-                    $errors[] = sprintf(__('The following query has failed: "%s"'), $routine_query) . '<br /><br />'
-                                      . __('MySQL said: ') . PMA_DBI_getError(null);
+                    $errors[] = sprintf(
+                        __('The following query has failed: "%s"'),
+                        htmlspecialchars($routine_query)
+                    )
+                    . '<br /><br />'
+                    . __('MySQL said: ') . PMA_DBI_getError(null);
                 } else {
                     $message = PMA_Message::success(__('Routine %1$s has been created.'));
                     $message->addParam(PMA_backquote($_REQUEST['item_name']));
                     $sql_query = $routine_query;
                 }
@@ -1249,12 +1266,18 @@ function PMA_RTN_handleExecute()
                     $notice = __('MySQL returned an empty result set (i.e. zero rows).');
                     $output .= PMA_message::notice($notice)->getDisplay();
                 }
             } else {
                 $output = '';
-                $message = PMA_message::error(sprintf(__('The following query has failed: "%s"'), $query) . '<br /><br />'
-                                                    . __('MySQL said: ') . PMA_DBI_getError(null));
+                $message = PMA_message::error(
+                    sprintf(
+                        __('The following query has failed: "%s"'),
+                        htmlspecialchars($query)
+                    )
+                    . '<br /><br />'
+                    . __('MySQL said: ') . PMA_DBI_getError(null)
+                );
             }
             // Print/send output
             if ($GLOBALS['is_ajax_request']) {
                 $extra_data = array('dialog' => false);
                 PMA_ajaxResponse(
diff --git a/libraries/rte/rte_triggers.lib.php b/libraries/rte/rte_triggers.lib.php
index 4e344ce474d..cc76685f042 100644
--- a/libraries/rte/rte_triggers.lib.php
+++ b/libraries/rte/rte_triggers.lib.php
@@ -70,27 +70,40 @@ function PMA_TRI_handleEditor()
                 $trigger = PMA_TRI_getDataFromName($_REQUEST['item_original_name']);
                 $create_item = $trigger['create'];
                 $drop_item = $trigger['drop'] . ';';
                 $result = PMA_DBI_try_query($drop_item);
                 if (! $result) {
-                    $errors[] = sprintf(__('The following query has failed: "%s"'), $drop_item) . '<br />'
-                                      . __('MySQL said: ') . PMA_DBI_getError(null);
+                    $errors[] = sprintf(
+                        __('The following query has failed: "%s"'),
+                        htmlspecialchars($drop_item)
+                    )
+                    . '<br />'
+                    . __('MySQL said: ') . PMA_DBI_getError(null);
                 } else {
                     $result = PMA_DBI_try_query($item_query);
                     if (! $result) {
-                        $errors[] = sprintf(__('The following query has failed: "%s"'), $item_query) . '<br />'
-                                          . __('MySQL said: ') . PMA_DBI_getError(null);
+                        $errors[] = sprintf(
+                            __('The following query has failed: "%s"'),
+                            htmlspecialchars($item_query)
+                        )
+                        . '<br />'
+                        . __('MySQL said: ') . PMA_DBI_getError(null);
                         // We dropped the old item, but were unable to create the new one
                         // Try to restore the backup query
                         $result = PMA_DBI_try_query($create_item);
                         if (! $result) {
                             // OMG, this is really bad! We dropped the query, failed to create a new one
                             // and now even the backup query does not execute!
                             // This should not happen, but we better handle this just in case.
-                            $errors[] = __('Sorry, we failed to restore the dropped trigger.') . '<br />'
-                                              . __('The backed up query was:') . "\"$create_item\"" . '<br />'
-                                              . __('MySQL said: ') . PMA_DBI_getError(null);
+                            $errors[] = __(
+                                'Sorry, we failed to restore the dropped trigger.'
+                            )
+                            . '<br />'
+                            . __('The backed up query was:')
+                            . "\"" . htmlspecialchars($create_item) . "\""
+                            . '<br />'
+                            . __('MySQL said: ') . PMA_DBI_getError(null);
                         }
                     } else {
                         $message = PMA_Message::success(__('Trigger %1$s has been modified.'));
                         $message->addParam(PMA_backquote($_REQUEST['item_name']));
                         $sql_query = $drop_item . $item_query;

Vulnerable code:                     $errors[] = sprintf(__('The following query has failed: "%s"'), $drop_item) . '<br />'
                                      . __('MySQL said: ') . PMA_DBI_getError(null);
                        $errors[] = sprintf(__('The following query has failed: "%s"'), $item_query) . '<br />'
                                          . __('MySQL said: ') . PMA_DBI_getError(null);
                            $errors[] = __('Sorry, we failed to restore the dropped event.') . '<br />'
                                              . __('The backed up query was:') . "\"$create_item\"" . '<br />'
                                              . __('MySQL said: ') . PMA_DBI_getError(null);
                    $errors[] = sprintf(__('The following query has failed: "%s"'), $item_query) . '<br /><br />'
                                      . __('MySQL said: ') . PMA_DBI_getError(null);
                        $errors[] = sprintf(__('The following query has failed: "%s"'), $drop_routine) . '<br />'
                                          . __('MySQL said: ') . PMA_DBI_getError(null);
                            $errors[] = sprintf(__('The following query has failed: "%s"'), $routine_query) . '<br />'
                                              . __('MySQL said: ') . PMA_DBI_getError(null);
                                $errors[] = __('Sorry, we failed to restore the dropped routine.') . '<br />'
                                                  . __('The backed up query was:') . "\"$create_routine\"" . '<br />'
                                                  . __('MySQL said: ') . PMA_DBI_getError(null);
                    $errors[] = sprintf(__('The following query has failed: "%s"'), $routine_query) . '<br /><br />'
                                      . __('MySQL said: ') . PMA_DBI_getError(null);
                $message = PMA_message::error(sprintf(__('The following query has failed: "%s"'), $query) . '<br /><br />'
                                                    . __('MySQL said: ') . PMA_DBI_getError(null));
                    $errors[] = sprintf(__('The following query has failed: "%s"'), $drop_item) . '<br />'
                                      . __('MySQL said: ') . PMA_DBI_getError(null);
                        $errors[] = sprintf(__('The following query has failed: "%s"'), $item_query) . '<br />'
                                          . __('MySQL said: ') . PMA_DBI_getError(null);
                            $errors[] = __('Sorry, we failed to restore the dropped trigger.') . '<br />'
                                              . __('The backed up query was:') . "\"$create_item\"" . '<br />'
                                              . __('MySQL said: ') . PMA_DBI_getError(null);
Fixed code:                     $errors[] = sprintf(
                        __('The following query has failed: "%s"'),
                        htmlspecialchars($drop_item)
                    )
                    . '<br />'
                    . __('MySQL said: ') . PMA_DBI_getError(null);
                        $errors[] = sprintf(
                            __('The following query has failed: "%s"'),
                            htmlspecialchars($item_query)
                        )
                        . '<br />'
                        . __('MySQL said: ') . PMA_DBI_getError(null);
                            $errors[] = __(
                                'Sorry, we failed to restore the dropped event.'
                            )
                            . '<br />'
                            . __('The backed up query was:')
                            . "\"" . htmlspecialchars($create_item) . "\""
                            . '<br />'
                            . __('MySQL said: ') . PMA_DBI_getError(null);
                    $errors[] = sprintf(
                        __('The following query has failed: "%s"'),
                        htmlspecialchars($item_query)
                    )
                    . '<br /><br />'
                    . __('MySQL said: ') . PMA_DBI_getError(null);
                        $errors[] = sprintf(
                            __('The following query has failed: "%s"'),
                            htmlspecialchars($drop_routine)
                        )
                        . '<br />'
                        . __('MySQL said: ') . PMA_DBI_getError(null);
                            $errors[] = sprintf(
                                __('The following query has failed: "%s"'),
                                htmlspecialchars($routine_query)
                            )
                            . '<br />'
                            . __('MySQL said: ') . PMA_DBI_getError(null);
                                $errors[] = __(
                                    'Sorry, we failed to restore the dropped routine.'
                                )
                                . '<br />'
                                . __('The backed up query was:')
                                . "\"" . htmlspecialchars($create_routine) . "\""
                                . '<br />'
                                . __('MySQL said: ') . PMA_DBI_getError(null);
                    $errors[] = sprintf(
                        __('The following query has failed: "%s"'),
                        htmlspecialchars($routine_query)
                    )
                    . '<br /><br />'
                    . __('MySQL said: ') . PMA_DBI_getError(null);
                $message = PMA_message::error(
                    sprintf(
                        __('The following query has failed: "%s"'),
                        htmlspecialchars($query)
                    )
                    . '<br /><br />'
                    . __('MySQL said: ') . PMA_DBI_getError(null)
                );
                    $errors[] = sprintf(
                        __('The following query has failed: "%s"'),
                        htmlspecialchars($drop_item)
                    )
                    . '<br />'
                    . __('MySQL said: ') . PMA_DBI_getError(null);
                        $errors[] = sprintf(
                            __('The following query has failed: "%s"'),
                            htmlspecialchars($item_query)
                        )
                        . '<br />'
                        . __('MySQL said: ') . PMA_DBI_getError(null);
                            $errors[] = __(
                                'Sorry, we failed to restore the dropped trigger.'
                            )
                            . '<br />'
                            . __('The backed up query was:')
                            . "\"" . htmlspecialchars($create_item) . "\""
                            . '<br />'
                            . __('MySQL said: ') . PMA_DBI_getError(null);