QID 150490

phpMyAdmin is a free and open source tool written in PHP for managing and administering databases such as the MySQL and MariaDB application systems.

In affected versions of phpMyadmin, an attacker can inject malicious code into aspects of the setup script, which could allow Cross-Site Scripting (XSS) or HTML injection.

Affected Versions:
phpMyAdmin versions from 5.1.x prior to 5.1.2.

QID Detection Logic (Unauthenticated):
This QID sends a specially crafted HTTP GET request to the vulnerable endpoint with a XSS payload inside the vulnerable parameter to determine the exploitation on target application.

Successful exploitation could allow an attacker to execute arbitrary JavaScript code in the context of the interface or allow the attacker to access sensitive, browser-based information.