CVE-2012-5339 (PHP, published 2012-10-25T10:51Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/rte/rte_events.lib.php
libraries/rte/rte_routines.lib.php
libraries/rte/rte_triggers.lib.php
Commit message: triggers, routines, events : escape sql queries in error messages


Vulnerable code:
                    $errors[] = sprintf(__('The following query has failed: "%s"'), $drop_item) . '<br />'
                                      . __('MySQL said: ') . PMA_DBI_getError(null);
                        $errors[] = sprintf(__('The following query has failed: "%s"'), $item_query) . '<br />'
                                          . __('MySQL said: ') . PMA_DBI_getError(null);
                            $errors[] = __('Sorry, we failed to restore the dropped event.') . '<br />'
                                              . __('The backed up query was:') . "\"$create_item\"" . '<br />'
                                              . __('MySQL said: ') . PMA_DBI_getError(null);
                    $errors[] = sprintf(__('The following query has failed: "%s"'), $item_query) . '<br /><br />'
                                      . __('MySQL said: ') . PMA_DBI_getError(null);
                        $errors[] = sprintf(__('The following query has failed: "%s"'), $drop_routine) . '<br />'
                                          . __('MySQL said: ') . PMA_DBI_getError(null);
                            $errors[] = sprintf(__('The following query has failed: "%s"'), $routine_query) . '<br />'
                                              . __('MySQL said: ') . PMA_DBI_getError(null);
                                $errors[] = __('Sorry, we failed to restore the dropped routine.') . '<br />'
                                                  . __('The backed up query was:') . "\"$create_routine\"" . '<br />'
                                                  . __('MySQL said: ') . PMA_DBI_getError(null);
                    $errors[] = sprintf(__('The following query has failed: "%s"'), $routine_query) . '<br /><br />'
                                      . __('MySQL said: ') . PMA_DBI_getError(null);
                $message = PMA_message::error(sprintf(__('The following query has failed: "%s"'), $query) . '<br /><br />'
                                                    . __('MySQL said: ') . PMA_DBI_getError(null));
                    $errors[] = sprintf(__('The following query has failed: "%s"'), $drop_item) . '<br />'
                                      . __('MySQL said: ') . PMA_DBI_getError(null);
                        $errors[] = sprintf(__('The following query has failed: "%s"'), $item_query) . '<br />'
                                          . __('MySQL said: ') . PMA_DBI_getError(null);
                            $errors[] = __('Sorry, we failed to restore the dropped trigger.') . '<br />'
                                              . __('The backed up query was:') . "\"$create_item\"" . '<br />'
                                              . __('MySQL said: ') . PMA_DBI_getError(null);

Fixed code:
                    $errors[] = sprintf(
                        __('The following query has failed: "%s"'),
                        htmlspecialchars($drop_item)
                    )
                    . '<br />'
                    . __('MySQL said: ') . PMA_DBI_getError(null);
                        $errors[] = sprintf(
                            __('The following query has failed: "%s"'),
                            htmlspecialchars($item_query)
                        )
                        . '<br />'
                        . __('MySQL said: ') . PMA_DBI_getError(null);
                            $errors[] = __(
                                'Sorry, we failed to restore the dropped event.'
                            )
                            . '<br />'
                            . __('The backed up query was:')
                            . "\"" . htmlspecialchars($create_item) . "\""
                            . '<br />'
                            . __('MySQL said: ') . PMA_DBI_getError(null);
                    $errors[] = sprintf(
                        __('The following query has failed: "%s"'),
                        htmlspecialchars($item_query)
                    )
                    . '<br /><br />'
                    . __('MySQL said: ') . PMA_DBI_getError(null);
                        $errors[] = sprintf(
                            __('The following query has failed: "%s"'),
                            htmlspecialchars($drop_routine)
                        )
                        . '<br />'
                        . __('MySQL said: ') . PMA_DBI_getError(null);
                            $errors[] = sprintf(
                                __('The following query has failed: "%s"'),
                                htmlspecialchars($routine_query)
                            )
                            . '<br />'
                            . __('MySQL said: ') . PMA_DBI_getError(null);
                                $errors[] = __(
                                    'Sorry, we failed to restore the dropped routine.'
                                )
                                . '<br />'
                                . __('The backed up query was:')
                                . "\"" . htmlspecialchars($create_routine) . "\""
                                . '<br />'
                                . __('MySQL said: ') . PMA_DBI_getError(null);
                    $errors[] = sprintf(
                        __('The following query has failed: "%s"'),
                        htmlspecialchars($routine_query)
                    )
                    . '<br /><br />'
                    . __('MySQL said: ') . PMA_DBI_getError(null);
                $message = PMA_message::error(
                    sprintf(
                        __('The following query has failed: "%s"'),
                        htmlspecialchars($query)
                    )
                    . '<br /><br />'
                    . __('MySQL said: ') . PMA_DBI_getError(null)
                );
                    $errors[] = sprintf(
                        __('The following query has failed: "%s"'),
                        htmlspecialchars($drop_item)
                    )
                    . '<br />'
                    . __('MySQL said: ') . PMA_DBI_getError(null);
                        $errors[] = sprintf(
                            __('The following query has failed: "%s"'),
                            htmlspecialchars($item_query)
                        )
                        . '<br />'
                        . __('MySQL said: ') . PMA_DBI_getError(null);
                            $errors[] = __(
                                'Sorry, we failed to restore the dropped trigger.'
                            )
                            . '<br />'
                            . __('The backed up query was:')
                            . "\"" . htmlspecialchars($create_item) . "\""
                            . '<br />'
                            . __('MySQL said: ') . PMA_DBI_getError(null);