CVE-2014-8326: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to the libraries/DatabaseInterface.class.php code for SQL debug output and the js/server_status_monitor.js code for the server monitor page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-11-05T11:55Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, js/server_status_monitor.js
Commit date: 2014-10-21 08:45:09 +0530
Commit message: bug #4563 [security] XSS in monitor query analyzer

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>

Diff: diff --git a/ChangeLog b/ChangeLog
index 02d02217d058..c0597da6e9a3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,10 +1,11 @@
 phpMyAdmin - ChangeLog
 ======================
 
 4.2.10.1 (not yet released)
 - bug #4562 [security] XSS in debug SQL output
+- bug #4563 [security] XSS in monitor query analyzer
 
 4.2.10.0 (2014-10-11)
 - bug #4361 Can't change font size (when config.inc.php not present)
 - bug #4542 Tab key in column name not shown
 - bug       PDF export: title not present in PDF
diff --git a/js/server_status_monitor.js b/js/server_status_monitor.js
index 4432cafdc669..97684d8ced1a 100644
--- a/js/server_status_monitor.js
+++ b/js/server_status_monitor.js
@@ -1853,11 +1853,11 @@ AJAX.registerOnload('server_status_monitor.js', function () {
 
         var formatValue = function (name, value) {
             if (name == 'user_host') {
                 return value.replace(/(\[.*?\])+/g, '');
             }
-            return value;
+            return escapeHtml(value);
         };
 
         for (var i = 0, l = rows.length; i < l; i++) {
             if (i === 0) {
                 $.each(rows[0], function (key, value) {
@@ -2009,11 +2009,11 @@ AJAX.registerOnload('server_status_monitor.js', function () {
             }
             explain += '<p></p>';
             for (i = 0, l = data.explain.length; i < l; i++) {
                 explain += '<div class="explain-' + i + '"' + (i > 0 ?  'style="display:none;"' : '') + '>';
                 $.each(data.explain[i], function (key, value) {
-                    value = (value === null) ? 'null' : value;
+                    value = (value === null) ? 'null' : escapeHtml(value);
 
                     if (key == 'type' && value.toLowerCase() == 'all') {
                         value = '<span class="attention">' + value + '</span>';
                     }
                     if (key == 'Extra') {

Vulnerable code:             return value;
                    value = (value === null) ? 'null' : value;
Fixed code: - bug #4563 [security] XSS in monitor query analyzer
            return escapeHtml(value);
                    value = (value === null) ? 'null' : escapeHtml(value);