CVE-2012-5368: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-10-25T10:51Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: js/functions.js, libraries/header_http.inc.php
Commit date: 2012-09-03 15:03:22 +0200
Commit message: Load JSON rather than javascript from phpmyadmin.net

Conflicts:
	js/functions.js
	libraries/Header.class.php

Diff: diff --git a/js/functions.js b/js/functions.js
index cdba36886d2..ad2e39c8cd7 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -126,17 +126,17 @@ function parseVersionString (str)
 }
 
 /**
  * Indicates current available version on main page.
  */
-function PMA_current_version()
+function PMA_current_version(data)
 {
     var current = parseVersionString(pmaversion);
-    var latest = parseVersionString(PMA_latest_version);
-    var version_information_message = PMA_messages['strLatestAvailable'] + ' ' + PMA_latest_version;
+    var latest = parseVersionString(data['version']);
+    var version_information_message = PMA_messages['strLatestAvailable'] + ' ' + data['version'];
     if (latest > current) {
-        var message = $.sprintf(PMA_messages['strNewerVersion'], PMA_latest_version, PMA_latest_date);
+        var message = $.sprintf(PMA_messages['strNewerVersion'], data['version'], data['date']);
         if (Math.floor(latest / 10000) == Math.floor(current / 10000)) {
             /* Security update */
             klass = 'error';
         } else {
             klass = 'notice';
@@ -1732,11 +1732,11 @@ function PMA_createProfilingChartJqplot(target, data)
     return $.jqplot(target, [data],
         {
             seriesDefaults: {
                 renderer: $.jqplot.PieRenderer,
                 rendererOptions: {
-                    showDataLabels:  true 
+                    showDataLabels:  true
                 }
             },
             legend: {
                 show: true,
                 location: 'e'
@@ -3216,11 +3216,11 @@ $(document).ready(function() {
 
     /**
      * Load version information asynchronously.
      */
     if ($('.jsversioncheck').length > 0) {
-        $.getScript('http://www.phpmyadmin.net/home_page/version.js', PMA_current_version);
+        $.getJSON('http://www.phpmyadmin.net/home_page/version.json', {}, PMA_current_version);
     }
 
     /**
      * Slider effect.
      */
diff --git a/libraries/header_http.inc.php b/libraries/header_http.inc.php
index 6bc295bc059..e8126456f3b 100644
--- a/libraries/header_http.inc.php
+++ b/libraries/header_http.inc.php
@@ -20,11 +20,11 @@
  */
 $GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT';
 /* Prevent against ClickJacking by allowing frames only from same origin */
 if (!$GLOBALS['cfg']['AllowThirdPartyFraming']) {
     header('X-Frame-Options: SAMEORIGIN');
-    header("X-Content-Security-Policy: allow 'self'; options inline-script eval-script; frame-ancestors 'self'; img-src 'self' data:; script-src 'self' http://www.phpmyadmin.net");
+    header("X-Content-Security-Policy: allow 'self' http://www.phpmyadmin.net; options inline-script eval-script; frame-ancestors 'self'; img-src 'self' data:");
     header("X-WebKit-CSP: allow 'self' http://www.phpmyadmin.net; options inline-script eval-script");
 }
 PMA_no_cache_header();
 if (!defined('IS_TRANSFORMATION_WRAPPER')) {
     // Define the charset to be used

Vulnerable code: function PMA_current_version()
    var latest = parseVersionString(PMA_latest_version);
    var version_information_message = PMA_messages['strLatestAvailable'] + ' ' + PMA_latest_version;
        var message = $.sprintf(PMA_messages['strNewerVersion'], PMA_latest_version, PMA_latest_date);
                    showDataLabels:  true 
        $.getScript('http://www.phpmyadmin.net/home_page/version.js', PMA_current_version);
    header("X-Content-Security-Policy: allow 'self'; options inline-script eval-script; frame-ancestors 'self'; img-src 'self' data:; script-src 'self' http://www.phpmyadmin.net");
Fixed code: function PMA_current_version(data)
    var latest = parseVersionString(data['version']);
    var version_information_message = PMA_messages['strLatestAvailable'] + ' ' + data['version'];
        var message = $.sprintf(PMA_messages['strNewerVersion'], data['version'], data['date']);
                    showDataLabels:  true
        $.getJSON('http://www.phpmyadmin.net/home_page/version.json', {}, PMA_current_version);
    header("X-Content-Security-Policy: allow 'self' http://www.phpmyadmin.net; options inline-script eval-script; frame-ancestors 'self'; img-src 'self' data:");