| Package | Affected versions | Patched versions |
|---|---|---|
| phpmyadmin/phpmyadmin | ≥ 4.3.0, < 4.9.11≥ 5.0, < 5.2.1 | 4.9.115.2.1 |
| phpmyadmin | ≥ 5.0.0, < 5.2.1< 4.9.11 | 5.2.14.9.11 |
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger Cross-site Scripting (XSS) by uploading a crafted .sql file through the drag-and-drop interface. By disabling the configuration directive $cfg['enable_drag_drop_import'], users will be unable to use the drag and drop upload which would protect against the vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free