CVE-2014-4348: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name that is improperly handled after presence in (a) the favorite list or (b) recent tables.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-06-25T11:19Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/RecentFavoriteTable.class.php
Commit date: 2014-06-19 12:52:52 +0200
Commit message: Fix XSS in PMA_RecentFavoriteTable::getHtmlList()

Signed-off-by: Ann + J.M <phpMyAdmin@ZweiSteinSoft.de>

Diff: diff --git a/libraries/RecentFavoriteTable.class.php b/libraries/RecentFavoriteTable.class.php
index bc8cc5873e47..9221ba38b6c8 100644
--- a/libraries/RecentFavoriteTable.class.php
+++ b/libraries/RecentFavoriteTable.class.php
@@ -201,43 +201,51 @@ public function getHtmlList()
         $html = '';
         if (count($this->_tables)) {
             if ($this->_tableType == 'recent') {
                 foreach ($this->_tables as $table) {
                     $html .= '<li class="warp_link">';
-                    $html .= '<a href="sql.php?server=' . $GLOBALS['server']
-                          . '&db=' . $table['db']
-                          . '&table=' . $table['table']
-                          . '&token=' . $_SESSION[' PMA_token '] . '">`'
+                    $recent_params = array(
+                        'db'    => $table['db'],
+                        'table' => $table['table']
+                    );
+                    $recent_url = 'sql.php'
+                        . PMA_URL_getCommon($recent_params);
+                    $html .= '<a href="' . $recent_url . '">`'
                           . htmlspecialchars($table['db']) . '`.`'
                           . htmlspecialchars($table['table']) . '`</a>';
                     $html .= '</li>';
                 }
             } else {
                 foreach ($this->_tables as $table) {
                     $html .= '<li class="warp_link">';
 
-                    $html .= '<a class="ajax favorite_table_anchor"';
-                    $fav_params = array('db' => $table['db'],
-                        'ajax_request' => true,
-                        'favorite_table' => $table['table'],
-                        'remove_favorite' => true);
+                    $html .= '<a class="ajax favorite_table_anchor" ';
+                    $fav_params = array(
+                        'db'              => $table['db'],
+                        'ajax_request'    => true,
+                        'favorite_table'  => $table['table'],
+                        'remove_favorite' => true
+                    );
                     $fav_rm_url = 'db_structure.php'
                         . PMA_URL_getCommon($fav_params);
                     $html .= 'href="' . $fav_rm_url
                         . '" title="' . __("Remove from Favorites")
                         . '" data-favtargetn="'
                         . md5($table['db'] . "." . $table['table'])
                         . '" >'
                         . PMA_Util::getIcon('b_favorite.png')
                         . '</a>';
 
-                    $html .= '<a href="sql.php?server=' . $GLOBALS['server']
-                          . '&db=' . $table['db']
-                          . '&table=' . $table['table']
-                          . '&token=' . $_SESSION[' PMA_token '] . '">`'
-                          . htmlspecialchars($table['db']) . '`.`'
-                          . htmlspecialchars($table['table']) . '`</a>';
+                    $fav_params = array(
+                        'db'    => $table['db'],
+                        'table' => $table['table']
+                    );
+                    $table_url = 'sql.php'
+                        . PMA_URL_getCommon($fav_params);
+                    $html .= '<a href="' . $table_url . '">`'
+                        . htmlspecialchars($table['db']) . '`.`'
+                        . htmlspecialchars($table['table']) . '`</a>';
                     $html .= '</li>';
                 }
             }
         } else {
             $html .= '<li class="warp_link">'

Vulnerable code:                     $html .= '<a href="sql.php?server=' . $GLOBALS['server']
                          . '&db=' . $table['db']
                          . '&table=' . $table['table']
                          . '&token=' . $_SESSION[' PMA_token '] . '">`'
                    $html .= '<a class="ajax favorite_table_anchor"';
                    $fav_params = array('db' => $table['db'],
                        'ajax_request' => true,
                        'favorite_table' => $table['table'],
                        'remove_favorite' => true);
                    $html .= '<a href="sql.php?server=' . $GLOBALS['server']
                          . '&db=' . $table['db']
                          . '&table=' . $table['table']
                          . '&token=' . $_SESSION[' PMA_token '] . '">`'
                          . htmlspecialchars($table['db']) . '`.`'
                          . htmlspecialchars($table['table']) . '`</a>';
Fixed code:                     $recent_params = array(
                        'db'    => $table['db'],
                        'table' => $table['table']
                    );
                    $recent_url = 'sql.php'
                        . PMA_URL_getCommon($recent_params);
                    $html .= '<a href="' . $recent_url . '">`'
                    $html .= '<a class="ajax favorite_table_anchor" ';
                    $fav_params = array(
                        'db'              => $table['db'],
                        'ajax_request'    => true,
                        'favorite_table'  => $table['table'],
                        'remove_favorite' => true
                    );
                    $fav_params = array(
                        'db'    => $table['db'],
                        'table' => $table['table']
                    );
                    $table_url = 'sql.php'
                        . PMA_URL_getCommon($fav_params);
                    $html .= '<a href="' . $table_url . '">`'
                        . htmlspecialchars($table['db']) . '`.`'
                        . htmlspecialchars($table['table']) . '`</a>';