CVE-2014-8958: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-11-30T11:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, libraries/mult_submits.lib.php
Commit date: 2014-11-20 06:36:55 +0530
Commit message: bug #4598 [security] XSS in multi submit

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>

Diff: diff --git a/ChangeLog b/ChangeLog
index 7877bcb3f647..e42d9763c08c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -16,10 +16,11 @@ phpMyAdmin - ChangeLog
 - bug #4596 [security] XSS through exception stack
 - bug #4595 [security] Path traversal can lead to leakage of line count
 - bug #4578 [security] XSS vulnerability in table print view
 - bug #4579 [security] XSS vulnerability in zoom search page
 - bug #4594 [security] Path traversal in file inclusion of GIS factory
+- bug #4598 [security] XSS in multi submit
 
 4.2.11.0 (2014-10-31)
 - bug       ReferenceError: Table_onover is not defined
 - bug #4552 Incorrect routines display for database due to case insensitive checks
 - bug #4259 reCaptcha sound session expired problem
diff --git a/libraries/mult_submits.lib.php b/libraries/mult_submits.lib.php
index a73a008e8550..78ef2441e49e 100644
--- a/libraries/mult_submits.lib.php
+++ b/libraries/mult_submits.lib.php
@@ -552,17 +552,18 @@ function PMA_getQueryFromSelected($what, $db, $table, $selected, $action, $views
     $selected_cnt   = count($selected);
     $i = 0;
     foreach ($selected as $sval) {
         switch ($what) {
         case 'row_delete':
-            $full_query .= 'DELETE FROM ' . PMA_Util::backquote($db)
-                . '.' . PMA_Util::backquote($table)
+            $full_query .= 'DELETE FROM '
+                . PMA_Util::backquote(htmlspecialchars($db))
+                . '.' . PMA_Util::backquote(htmlspecialchars($table))
                 // Do not append a "LIMIT 1" clause here
                 // (it's not binlog friendly).
                 // We don't need the clause because the calling panel permits
                 // this feature only when there is a unique index.
-                . ' WHERE ' . urldecode($sval)
+                . ' WHERE ' . urldecode(htmlspecialchars($sval))
                 . ';<br />';
             break;
         case 'drop_db':
             $full_query .= 'DROP DATABASE '
                 . PMA_Util::backquote(htmlspecialchars($sval))

Vulnerable code:             $full_query .= 'DELETE FROM ' . PMA_Util::backquote($db)
                . '.' . PMA_Util::backquote($table)
                . ' WHERE ' . urldecode($sval)
Fixed code: - bug #4598 [security] XSS in multi submit
            $full_query .= 'DELETE FROM '
                . PMA_Util::backquote(htmlspecialchars($db))
                . '.' . PMA_Util::backquote(htmlspecialchars($table))
                . ' WHERE ' . urldecode(htmlspecialchars($sval))