CVE-2022-23807

An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.

An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.

An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.

An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.

A flaw was identified in how phpMyAdmin processes two factor authentication; a user could potentially manipulate their account to bypass two factor authentication in subsequent authentication sessions (PMASA-2022-1).

A series of weaknesses was identified allowing a malicious user to submit malicious information to present an XSS or HTML injection attack in the graphical setup page (PMASA-2022-2).

In some scenarios, potentially sensitive information such as a the database name can be part of the URL. This can now be optionally encrypted.

During a failed log on attempt, the error message reveals the target database server's hostname or IP address. This can reveal some information about the network infrastructure to an attacker.

Fixed some situations where a user is logged out when working with more than one server

Fixed a problem with assigning privileges to a user using the multiselect list when the database name has an underscore

Enable cookie parameter "SameSite" when the PHP version is 7.3 or newer.

This update for phpMyAdmin fixes the following issues:

phpMyAdmin was updated to 5.2.1

This is a security and bufix release.

• Security:

  • Fix (PMASA-2023-01, CWE-661, boo#1208186, CVE-2023-25727) Fix an XSS attack through the drag-and-drop upload feature.

• Bugfixes:

  • issue #17522 Fix case where the routes cache file is invalid
  • issue #17506 Fix error when configuring 2FA without XMLWriter or Imagick
  • issue Fix blank page when some error occurs
  • issue #17519 Fix Export pages not working in certain conditions
  • issue #17496 Fix error in table operation page when partitions are broken
  • issue #17386 Fix system memory and system swap values on Windows
  • issue #17517 Fix Database Server panel not getting hidden by ShowServerInfo configuration directive
  • issue #17271 Fix database names not showing on Processes tab
  • issue #17424 Fix export limit size calculation
  • issue #17366 Fix refresh rate popup on Monitor page
  • issue #17577 Fix monitor charts size on RTL languages
  • issue #17121 Fix password_hash function incorrectly adding single quotes to password before hashing
  • issue #17586 Fix statistics not showing for empty databases
  • issue #17592 Clicking on the New index link on the sidebar does not throw an error anymore
  • issue #17584 It's now possible to browse a database that includes two % in its name
  • issue Fix PHP 8.2 deprecated string interpolation syntax
  • issue Some languages are now correctly detected from the HTTP header
  • issue #17617 Sorting is correctly remembered when $cfg['RememberSorting'] is true
  • issue #17593 Table filtering now works when action buttons are on the right side of the row
  • issue #17388 Find and Replace using regex now makes a valid query if no matching result set found
  • issue #17551 Enum/Set editor will not fail to open when creating a new column
  • issue #17659 Fix error when a database group is named tables, views, functions, procedures or events
  • issue #17673 Allow empty values to be inserted into columns
  • issue #17620 Fix error handling at phpMyAdmin startup for the JS SQL console
  • issue Fixed debug queries console broken UI for query time and group count
  • issue Fixed escaping of SQL query and errors for the debug console
  • issue Fix console toolbar UI when the bookmark feature is disabled and sql debug is enabled
  • issue #17543 Fix JS error on saving a new designer page
  • issue #17546 Fix JS error after using save as and open page operation on the designer
  • issue Fix PHP warning on GIS visualization when there is only one GIS column
  • issue #17728 Some select HTML tags will now have the correct UI style
  • issue #17734 PHP deprecations will only be shown when in a development environment
  • issue #17369 Fix server error when blowfish_secret is not exactly 32 bytes long
  • issue #17736 Add utf8mb3 as an alias of utf8 on the charset description page
  • issue #16418 Fix FAQ 1.44 about manually removing vendor folders
  • issue #12359 Setup page now sends the Content-Security-Policy headers
  • issue #17747 The Column Visibility Toggle will not be hidden by other elements
  • issue #17756 Edit/Copy/Delete row now works when using GROUP BY
  • issue #17248 Support the UUID data type for MariaDB >= 10.7
  • issue #17656 Fix replace/change/set table prefix is not working
  • issue Fix monitor page filter queries only filtering the first row
  • issue Fix 'Link not found!' on foreign columns for tables having no char column to show
  • issue #17390 Fix 'Create view' modal doesn't show on results and empty results
  • issue #17772 Fix wrong styles for add button from central columns
  • issue #17389 Fix HTML disappears when exporting settings to browser's storage
  • issue #17166 Fix 'Warning: #1287 'X' is deprecated [...] Please use ST_X instead.' on search page
  • issue Use jquery-migrate.min.js (14KB) instead of jquery-migrate.min.js…

This update for phpMyAdmin fixes the following issues:

Update to 4.9.11:

• CVE-2023-25727: Fixed XSS vulnerability in drag-and-drop upload (boo#1208186).

These are all security issues fixed in the phpMyAdmin-5.1.2-1.1 package on the GA media of openSUSE Tumbleweed.