CVE-2014-4349: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-06-25T11:19Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/navigation/Navigation.class.php, libraries/navigation/Nodes/Node_DatabaseChild.class.php
Commit date: 2014-06-19 12:57:59 +0200
Commit message: Fix XSS in Hide navigation items feature

Signed-off-by: Ann + J.M <phpMyAdmin@ZweiSteinSoft.de>

Diff: diff --git a/libraries/navigation/Navigation.class.php b/libraries/navigation/Navigation.class.php
index b7827f6b1cd2..d036c7e54cc2 100644
--- a/libraries/navigation/Navigation.class.php
+++ b/libraries/navigation/Navigation.class.php
@@ -187,13 +187,13 @@ public function getItemUnhideDialog($dbName, $itemType = null, $tableName = null
                         $html .= '<tr class="' . ($odd ? 'odd' : 'even') . '">';
                         $html .= '<td>' . htmlspecialchars($hiddenItem) . '</td>';
                         $html .= '<td style="width:80px"><a href="navigation.php?'
                             . PMA_URL_getCommon()
                             . '&unhideNavItem=true'
-                            . '&itemType=' . $t
-                            . '&itemName=' . urldecode($hiddenItem)
-                            . '&dbName=' . urldecode($dbName) . '"'
+                            . '&itemType=' . urlencode($t)
+                            . '&itemName=' . urlencode($hiddenItem)
+                            . '&dbName=' . urlencode($dbName) . '"'
                             . ' class="unhideNavItem ajax">'
                             . PMA_Util::getIcon('lightbulb.png', __('Show'))
                             .  '</a></td>';
                         $odd = ! $odd;
                     }
diff --git a/libraries/navigation/Nodes/Node_DatabaseChild.class.php b/libraries/navigation/Nodes/Node_DatabaseChild.class.php
index 6e0a7ec57f75..962a48c0109a 100644
--- a/libraries/navigation/Nodes/Node_DatabaseChild.class.php
+++ b/libraries/navigation/Nodes/Node_DatabaseChild.class.php
@@ -30,13 +30,13 @@ public function getHtmlForControlButtons()
             $item = $this->real_name;
             $ret  = '<span class="navItemControls">'
                 . '<a href="navigation.php?'
                 . PMA_URL_getCommon()
                 . '&hideNavItem=true'
-                . '&itemType=' . urldecode($this->getItemType())
-                . '&itemName=' . urldecode($item)
-                . '&dbName=' . urldecode($db) . '"'
+                . '&itemType=' . urlencode($this->getItemType())
+                . '&itemName=' . urlencode($item)
+                . '&dbName=' . urlencode($db) . '"'
                 . ' class="hideNavItem ajax">'
                 . PMA_Util::getImage('lightbulb_off.png', __('Hide'))
                 . '</a></span>';
         }
         return $ret;

Vulnerable code:                             . '&itemType=' . $t
                            . '&itemName=' . urldecode($hiddenItem)
                            . '&dbName=' . urldecode($dbName) . '"'
                . '&itemType=' . urldecode($this->getItemType())
                . '&itemName=' . urldecode($item)
                . '&dbName=' . urldecode($db) . '"'
Fixed code:                             . '&itemType=' . urlencode($t)
                            . '&itemName=' . urlencode($hiddenItem)
                            . '&dbName=' . urlencode($dbName) . '"'
                . '&itemType=' . urlencode($this->getItemType())
                . '&itemName=' . urlencode($item)
                . '&dbName=' . urlencode($db) . '"'