phpMyAdmin Stored XSS and Privilege Escalation via tbl_export.php SVG Sanitizer Bypass

Based on the user's request, I need to extract key information about the vulnerability from the provided webpage screenshot and summarize it in concise Chinese markdown format. 1. Vulnerability Overview: Title: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation. Description: In phpMyAdmin's , the parameter allows injection of tags using HTML entity encoding ( ). This allows attackers to exploit permissions to execute arbitrary JavaScript code, thereby bypassing the Sanitizer. Impact: Stored XSS and Privilege Escalation. Attackers can create administrator accounts, modify existing accounts, delete databases, etc. CVSS: 9.8 (Critical). 2. Affected Versions: Affected: < 4.8.0 Archived: 4.8.1 (This means version 4.8.1 and higher are patched). 3. Fix: The page explicitly states: "The upgrade solution is an immediate upgrade to phpMyAdmin version 4.8.1 or higher." It also mentions: "The vulnerability exists in phpMyAdmin installation using tbl_export.php since released 2008-01-15. Recommended to replace export function with an SQL export function or use SQL file for export." 4. POC/Exploit Code: There are two main code blocks on the page demonstrating XSS and privilege escalation exploits. XSS POC: (Note: This is the injected content; actual exploitation is done by passing the encoded string via URL parameters) The URL parameter mentioned in the actual exploitation steps is: `tbl_export.php?export_type=%3cscript%3ealert(document.cookie)%3c%2fscript%3e&table=test&db=test&single_table=1&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=0&goto=tbl_export.php&sql_query=SELECT++FROM+test&limit_to=100&limit_from=

Goal Reached Thanks to every supporter — we hit 100%!

phpMyAdmin Stored XSS and Privilege Escalation via tbl_export.php SVG Sanitizer Bypass

More from this source