GitHub Advisoryadvisory · Packagist

GHSA-9pgx-gcph-mpqr vrana/adminer via XSS in the history parameter in SQL command

MEDIUM Published 2021-02-11 Modified 2023-09-21 Official page ↗
Aliases
CVE-2020-35572
Ecosystem
Packagist
Packages
vrana/adminer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-02-11

Affected packages

• Packagist vrana/adminer: < 4.7.9 → fixed in 4.7.9

Description

Impact Users of Adminer versions supporting SQL command (most versions, e.g. MySQL) using browsers not encoding URL parameters before sending to server (likely Edge, not Chrome, not Firefox) are affected. Patches Patched by 5c395afc, included in version 4.7.9. Workarounds Use browser which encodes URL parameters (e.g. Chrome or Firefox). References https://sourceforge.net/p/adminer/bugs-and-features/775/ For more information If you have any questions or comments about this advisory: • Comment at https://sourceforge.net/p/adminer/bugs-and-features/775/

Related

Alias · CVE (1)

  • CVE-2020-35572 Adminer through 4.7.8 allows XSS via the history parameter to the default URI. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References