CVE-2022-0813

PhpMyAdmin before 5.1.3 allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.

PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.

PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.

This update for phpMyAdmin fixes the following issues:

phpMyAdmin was updated to 5.2.1

This is a security and bufix release.

• Security:

  • Fix (PMASA-2023-01, CWE-661, boo#1208186, CVE-2023-25727) Fix an XSS attack through the drag-and-drop upload feature.

• Bugfixes:

  • issue #17522 Fix case where the routes cache file is invalid
  • issue #17506 Fix error when configuring 2FA without XMLWriter or Imagick
  • issue Fix blank page when some error occurs
  • issue #17519 Fix Export pages not working in certain conditions
  • issue #17496 Fix error in table operation page when partitions are broken
  • issue #17386 Fix system memory and system swap values on Windows
  • issue #17517 Fix Database Server panel not getting hidden by ShowServerInfo configuration directive
  • issue #17271 Fix database names not showing on Processes tab
  • issue #17424 Fix export limit size calculation
  • issue #17366 Fix refresh rate popup on Monitor page
  • issue #17577 Fix monitor charts size on RTL languages
  • issue #17121 Fix password_hash function incorrectly adding single quotes to password before hashing
  • issue #17586 Fix statistics not showing for empty databases
  • issue #17592 Clicking on the New index link on the sidebar does not throw an error anymore
  • issue #17584 It's now possible to browse a database that includes two % in its name
  • issue Fix PHP 8.2 deprecated string interpolation syntax
  • issue Some languages are now correctly detected from the HTTP header
  • issue #17617 Sorting is correctly remembered when $cfg['RememberSorting'] is true
  • issue #17593 Table filtering now works when action buttons are on the right side of the row
  • issue #17388 Find and Replace using regex now makes a valid query if no matching result set found
  • issue #17551 Enum/Set editor will not fail to open when creating a new column
  • issue #17659 Fix error when a database group is named tables, views, functions, procedures or events
  • issue #17673 Allow empty values to be inserted into columns
  • issue #17620 Fix error handling at phpMyAdmin startup for the JS SQL console
  • issue Fixed debug queries console broken UI for query time and group count
  • issue Fixed escaping of SQL query and errors for the debug console
  • issue Fix console toolbar UI when the bookmark feature is disabled and sql debug is enabled
  • issue #17543 Fix JS error on saving a new designer page
  • issue #17546 Fix JS error after using save as and open page operation on the designer
  • issue Fix PHP warning on GIS visualization when there is only one GIS column
  • issue #17728 Some select HTML tags will now have the correct UI style
  • issue #17734 PHP deprecations will only be shown when in a development environment
  • issue #17369 Fix server error when blowfish_secret is not exactly 32 bytes long
  • issue #17736 Add utf8mb3 as an alias of utf8 on the charset description page
  • issue #16418 Fix FAQ 1.44 about manually removing vendor folders
  • issue #12359 Setup page now sends the Content-Security-Policy headers
  • issue #17747 The Column Visibility Toggle will not be hidden by other elements
  • issue #17756 Edit/Copy/Delete row now works when using GROUP BY
  • issue #17248 Support the UUID data type for MariaDB >= 10.7
  • issue #17656 Fix replace/change/set table prefix is not working
  • issue Fix monitor page filter queries only filtering the first row
  • issue Fix 'Link not found!' on foreign columns for tables having no char column to show
  • issue #17390 Fix 'Create view' modal doesn't show on results and empty results
  • issue #17772 Fix wrong styles for add button from central columns
  • issue #17389 Fix HTML disappears when exporting settings to browser's storage
  • issue #17166 Fix 'Warning: #1287 'X' is deprecated [...] Please use ST_X instead.' on search page
  • issue Use jquery-migrate.min.js (14KB) instead of jquery-migrate.min.js…

These are all security issues fixed in the phpMyAdmin-5.2.0-2.1 package on the GA media of openSUSE Tumbleweed.