CVE-2014-8958: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-11-30T11:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: ChangeLog, libraries/Config.class.php, libraries/Theme.class.php
Commit date: 2014-11-20 06:40:39 +0530
Commit message: bug #4597 [security] XSS through pma_fontsize cookie

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>

Diff: diff --git a/ChangeLog b/ChangeLog
index e42d9763c08c..a5122c22c54b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -17,10 +17,11 @@ phpMyAdmin - ChangeLog
 - bug #4595 [security] Path traversal can lead to leakage of line count
 - bug #4578 [security] XSS vulnerability in table print view
 - bug #4579 [security] XSS vulnerability in zoom search page
 - bug #4594 [security] Path traversal in file inclusion of GIS factory
 - bug #4598 [security] XSS in multi submit
+- bug #4597 [security] XSS through pma_fontsize cookie
 
 4.2.11.0 (2014-10-31)
 - bug       ReferenceError: Table_onover is not defined
 - bug #4552 Incorrect routines display for database due to case insensitive checks
 - bug #4259 reCaptcha sound session expired problem
diff --git a/libraries/Config.class.php b/libraries/Config.class.php
index a8adc06b60bc..f63764e58c03 100644
--- a/libraries/Config.class.php
+++ b/libraries/Config.class.php
@@ -1759,11 +1759,11 @@ static protected function getFontsizeSelection()
     {
         $current_size = $GLOBALS['PMA_Config']->get('fontsize');
         // for the case when there is no config file (this is supported)
         if (empty($current_size)) {
             if (isset($_COOKIE['pma_fontsize'])) {
-                $current_size = $_COOKIE['pma_fontsize'];
+                $current_size = htmlspecialchars($_COOKIE['pma_fontsize']);
             } else {
                 $current_size = '82%';
             }
         }
         $options = PMA_Config::getFontsizeOptions($current_size);
diff --git a/libraries/Theme.class.php b/libraries/Theme.class.php
index 5457647d9538..229eef6930e5 100644
--- a/libraries/Theme.class.php
+++ b/libraries/Theme.class.php
@@ -432,11 +432,11 @@ function getFontSize()
         $fs = $GLOBALS['PMA_Config']->get('fontsize');
         if (!is_null($fs)) {
             return $fs;
         }
         if (isset($_COOKIE['pma_fontsize'])) {
-            return $_COOKIE['pma_fontsize'];
+            return htmlspecialchars($_COOKIE['pma_fontsize']);
         }
         return '82%';
     }
 
     /**

Vulnerable code:                 $current_size = $_COOKIE['pma_fontsize'];
            return $_COOKIE['pma_fontsize'];
Fixed code: - bug #4597 [security] XSS through pma_fontsize cookie
                $current_size = htmlspecialchars($_COOKIE['pma_fontsize']);
            return htmlspecialchars($_COOKIE['pma_fontsize']);