hitoshura25/cvefixes huggingface dataset:
CVE-2013-3239 (PHP, published 2013-04-26T03:34Z)
Description: value: phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
export.php
Commit message: Security: remove dots in template to avoid a remote code execution vulnerability


Vulnerable code:

Fixed code:
    // remove dots in template to avoid a remote code execution vulnerability
    $filename_template = str_replace('.', '', $filename_template);
CVE-2013-3239 (PHP, published 2013-04-26T03:34Z)
Description: value: phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
export.php
libraries/sanitizing.lib.php
Commit message: Security: block another case of remote execution vulnerability


Vulnerable code:
    // remove dots in template to avoid a remote code execution vulnerability
    $filename_template = str_replace('.', '', $filename_template);
    $filename = PMA_sanitize_filename($filename);
 * Sanitize a filename by removing anything besides A-Za-z0-9_.-
 *    When using a filename in a Content-Disposition header the value should not contain ; or "
function PMA_sanitize_filename($filename) {
    $filename = preg_replace('/[^A-Za-z0-9_.-]/', '_', $filename);

Fixed code:
    // remove dots in filename (coming from either the template or already
    // part of the filename) to avoid a remote code execution vulnerability
    $filename = PMA_sanitize_filename($filename, $replaceDots = true);
 * Sanitize a filename by removing anything besides legit characters 
 *    When using a filename in a Content-Disposition header the value
 *    should not contain ; or "
 *
 *    When exporting, avoiding generation of an unexpected double-extension file
 * @param   boolean Whether to also replace dots 
function PMA_sanitize_filename($filename, $replaceDots = false) {
    $pattern = '/[^A-Za-z0-9_';
    // if we don't have to replace dots
    if (! $replaceDots) {
        // then add the dot to the list of legit characters
        $pattern .= '.';
    }
    $pattern .= '-]/';
    $filename = preg_replace($pattern, '_', $filename);
CVE-2013-3742 (PHP, published 2013-07-04T14:33Z)
Description: value: Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
view_create.php
Commit message: escape query in error message


Vulnerable code:
                    "<i>$sql_query</i><br /><br />" . PMA_DBI_getError()

Fixed code:
                    "<i>" . htmlspecialchars($sql_query) . "</i><br /><br />"
                    . PMA_DBI_getError()
CVE-2013-4729 (Other, published 2013-07-04T14:33Z)
Description: value: import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
import.php
Commit message: [security] Global variables scope injection vulnerability (see PMASA-2013-7)


Vulnerable code:

Fixed code:
4.0.4.1 ()
- [security] Global variables scope injection vulnerability (see PMASA-2013-7)

if (! in_array(
    $format, 
    array(
        'csv',
        'ldi',
        'mediawiki',
        'ods',
        'shp',
        'sql',
        'xml'
    )
)
) {
    // this should not happen for a normal user
    // but only during an attack
    PMA_fatalError('Incorrect format parameter');
}
CVE-2013-5029 (PHP, published 2013-08-19T23:55Z)
Description: value: phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
doc/config.rst
js/cross_framing_protection.js
libraries/Header.class.php
libraries/Scripts.class.php
libraries/config.default.php
libraries/config/messages.inc.php
libraries/config/setup.forms.php
Commit message: Readd AllowThirdPartyFraming option

We want by default no framing of phpMyAdmin, but still some sites might
need to embed it, so configuration option (with appropriate security
warning) is there.

This basically reverts d7e0bed28443e6cf8f41965cc2f27be19c667fa6.


Vulnerable code:
    'UseDbSearch');

Fixed code:
.. config:option:: $cfg['AllowThirdPartyFraming']

    :type: boolean
    :default: false
    
    Setting this to ``true`` allows phpMyAdmin to be included inside a frame,
    and is a potential security hole allowing cross-frame scripting attacks or
    clickjacking.

/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
 * Conditionally included if third-party framing is not allowed
 *
 */

try {
    if (top != self) {
        top.location.href = self.location.href;
    }
} catch(e) {
    alert("Redirecting... (error: " + e);
    top.location.href = self.location.href;
}

        // Cross-framing protection
        if ($GLOBALS['cfg']['AllowThirdPartyFraming'] === false) {
            $this->_scripts->addFile('cross_framing_protection.js');
        }

            /* Prevent against ClickJacking by disabling framing */
            if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {
                header(
                    'X-Frame-Options: DENY'
                );
            }
            || strpos($filename, 'cross_framing_protection.js') !== false
/**
 * Allows phpMyAdmin to be included from a other document in a frame;
 * setting this to true is a potential security hole
 *
 * @global boolean $cfg['AllowThirdPartyFraming']
 */
$cfg['AllowThirdPartyFraming'] = false;

$strConfigAllowThirdPartyFraming_desc = __('Enabling this allows a page located on a different domain to call phpMyAdmin inside a frame, and is a potential [strong]security hole[/strong] allowing cross-frame scripting attacks');
$strConfigAllowThirdPartyFraming_name = __('Allow third party framing');
    'UseDbSearch',
    'AllowThirdPartyFraming');
CVE-2013-5029 (PHP, published 2013-08-19T23:55Z)
Description: value: phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
js/cross_framing_protection.js
libraries/Header.class.php
Commit message: Improved protection against cross framing

We now include CSS to hide the page and display it conditionally after
checking we're in top frame. This adds extra protection for clients who
do not support X-Frame-Options.

See also http://en.wikipedia.org/wiki/Framekiller and
https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet


Vulnerable code:
 * Conditionally included if third-party framing is not allowed
 *

try {
    if (top != self) {
        top.location.href = self.location.href;
    }
} catch(e) {
    alert("Redirecting... (error: " + e);
    top.location.href = self.location.href;

Fixed code:
 * Conditionally included if framing is not allowed
if(self == top) {
    document.documentElement.style.display = 'block' ;
} else {
    top.location = self.location ;
        $retval .= '<style>html{display: none;}</style>';
CVE-2013-5029 (Other, published 2013-08-19T23:55Z)
Description: value: phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
Commit message: ChangeLog entry for Improved protection against cross framing


Vulnerable code:

Fixed code:
- [security] Improved protection against cross framing, see PMASA-2013-10
+ Reinstated configuration directive: AllowThirdPartyFraming
CVE-2013-5029 (PHP, published 2013-08-19T23:55Z)
Description: value: phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/Header.class.php
Commit message: Display none only if protection is enabled


Vulnerable code:
        $retval .= '<style>html{display: none;}</style>';

Fixed code:
        if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {
            $retval .= '<style>html{display: none;}</style>';
        }
CVE-2014-1879 (PHP, published 2014-02-20T15:27Z)
Description: value: Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
import.php
Commit message: Sanitize filename in import message

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
            $message->addString('(' . $local_import_file . ')');
            $message->addString('(' . $_FILES['import_file']['name'] . ')');

Fixed code:
            $message->addString('(' . htmlspecialchars($local_import_file) . ')');
            $message->addString('(' . htmlspecialchars($_FILES['import_file']['name']) . ')');
CVE-2014-4348 (PHP, published 2014-06-25T11:19Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name that is improperly handled after presence in (a) the favorite list or (b) recent tables.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/RecentFavoriteTable.class.php
libraries/structure.lib.php
Commit message: Fix XSS in recent/favorite tables list feature

Signed-off-by: Ann + J.M <phpMyAdmin@ZweiSteinSoft.de>


Vulnerable code:
                          . '&token=' . $_SESSION[' PMA_token ']
                          . '">`' . $table['db'] . '`.`' . $table['table'] . '`</a>';
                        . '" data-favtargetn="' . $table['db'] . "." . $table['table']
                          . '&token=' . $_SESSION[' PMA_token ']
                          . '">`' . $table['db'] . '`.`' . $table['table'] . '`</a>';
    $html_output .= 'id="' . preg_replace(
        '/\s+/', '', $current_table['TABLE_NAME']
    ) . '_favorite_anchor" ';
        (($already_favorite?'remove':'add') . '_favorite') => true);
        . '" data-favtargets="' . $db . "." . $current_table['TABLE_NAME']

Fixed code:
                          . '&token=' . $_SESSION[' PMA_token '] . '">`'
                          . htmlspecialchars($table['db']) . '`.`'
                          . htmlspecialchars($table['table']) . '`</a>';
                        . '" data-favtargetn="'
                        . md5($table['db'] . "." . $table['table'])
                          . '&token=' . $_SESSION[' PMA_token '] . '">`'
                          . htmlspecialchars($table['db']) . '`.`'
                          . htmlspecialchars($table['table']) . '`</a>';
    $html_output .= 'id="' . md5($current_table['TABLE_NAME'])
        . '_favorite_anchor" ';
        (($already_favorite?'remove':'add') . '_favorite') => true
    );
        . '" data-favtargets="'
        . md5($db . "." . $current_table['TABLE_NAME'])
CVE-2014-4348 (PHP, published 2014-06-25T11:19Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name that is improperly handled after presence in (a) the favorite list or (b) recent tables.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/RecentFavoriteTable.class.php
Commit message: Fix XSS in PMA_RecentFavoriteTable::getHtmlList()

Signed-off-by: Ann + J.M <phpMyAdmin@ZweiSteinSoft.de>


Vulnerable code:
                    $html .= '<a href="sql.php?server=' . $GLOBALS['server']
                          . '&db=' . $table['db']
                          . '&table=' . $table['table']
                          . '&token=' . $_SESSION[' PMA_token '] . '">`'
                    $html .= '<a class="ajax favorite_table_anchor"';
                    $fav_params = array('db' => $table['db'],
                        'ajax_request' => true,
                        'favorite_table' => $table['table'],
                        'remove_favorite' => true);
                    $html .= '<a href="sql.php?server=' . $GLOBALS['server']
                          . '&db=' . $table['db']
                          . '&table=' . $table['table']
                          . '&token=' . $_SESSION[' PMA_token '] . '">`'
                          . htmlspecialchars($table['db']) . '`.`'
                          . htmlspecialchars($table['table']) . '`</a>';

Fixed code:
                    $recent_params = array(
                        'db'    => $table['db'],
                        'table' => $table['table']
                    );
                    $recent_url = 'sql.php'
                        . PMA_URL_getCommon($recent_params);
                    $html .= '<a href="' . $recent_url . '">`'
                    $html .= '<a class="ajax favorite_table_anchor" ';
                    $fav_params = array(
                        'db'              => $table['db'],
                        'ajax_request'    => true,
                        'favorite_table'  => $table['table'],
                        'remove_favorite' => true
                    );
                    $fav_params = array(
                        'db'    => $table['db'],
                        'table' => $table['table']
                    );
                    $table_url = 'sql.php'
                        . PMA_URL_getCommon($fav_params);
                    $html .= '<a href="' . $table_url . '">`'
                        . htmlspecialchars($table['db']) . '`.`'
                        . htmlspecialchars($table['table']) . '`</a>';
CVE-2014-4349 (PHP, published 2014-06-25T11:19Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/navigation/Navigation.class.php
libraries/navigation/Nodes/Node_DatabaseChild.class.php
Commit message: Fix XSS in Hide navigation items feature

Signed-off-by: Ann + J.M <phpMyAdmin@ZweiSteinSoft.de>


Vulnerable code:
                            . '&itemType=' . $t
                            . '&itemName=' . urldecode($hiddenItem)
                            . '&dbName=' . urldecode($dbName) . '"'
                . '&itemType=' . urldecode($this->getItemType())
                . '&itemName=' . urldecode($item)
                . '&dbName=' . urldecode($db) . '"'

Fixed code:
                            . '&itemType=' . urlencode($t)
                            . '&itemName=' . urlencode($hiddenItem)
                            . '&dbName=' . urlencode($dbName) . '"'
                . '&itemType=' . urlencode($this->getItemType())
                . '&itemName=' . urlencode($item)
                . '&dbName=' . urlencode($db) . '"'
CVE-2014-4954 (Other, published 2014-07-20T11:12Z)
Description: value: Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
libraries/structure.lib.php
Commit message: bug #4486 [security] XSS injection due to unescaped table comment

Signed-off-by: Marc Delisle <marc@infomarc.info>


Vulnerable code:
        . '&amp;pos=0" title="' . $current_table['TABLE_COMMENT'] . '">'

Fixed code:
- bug #4486 [security] XSS injection due to unescaped table comment
        . '&amp;pos=0" title="'
        . htmlspecialchars($current_table['TABLE_COMMENT']) . '">'
CVE-2014-4955 (Other, published 2014-07-20T11:12Z)
Description: value: Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
libraries/rte/rte_list.lib.php
Commit message: bug #4488 [security] XSS injection due to unescaped table name (triggers)

Signed-off-by: Marc Delisle <marc@infomarc.info>


Vulnerable code:
        $retval .= "                <a href='db_triggers.php?{$url_query}"
                                     . "&amp;table={$trigger['table']}'>"
                                     . $trigger['table'] . "</a>\n";

Fixed code:
- bug #4488 [security] XSS injection due to unescaped table name (triggers)
        $retval .= "<a href='db_triggers.php?{$url_query}"
            . "&amp;table=" . urlencode($trigger['table']) . "'>"
            . urlencode($trigger['table']) . "</a>";
CVE-2014-4986 (JavaScript, published 2014-07-20T11:12Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) table name or (2) column name that is improperly handled during construction of an AJAX confirmation message.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
js/functions.js
js/tbl_structure.js
Commit message: bug #4492 [security] XSS in AJAX confirmation messages

Signed-off-by: Marc Delisle <marc@infomarc.info>


Vulnerable code:
            'DROP TABLE ' + PMA_commonParams.get('table')
            'TRUNCATE ' + PMA_commonParams.get('table')

Fixed code:
- bug #4492 [security] XSS in AJAX confirmation messages
            'DROP TABLE ' + escapeHtml(PMA_commonParams.get('table'))
            'TRUNCATE ' + escapeHtml(PMA_commonParams.get('table'))
        curr_column_name = escapeHtml(curr_column_name);