Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlwZ3gtZ2NwaC1tcHFy

vrana/adminer via XSS in the history parameter in SQL command

Impact

Users of Adminer versions supporting SQL command (most versions, e.g. MySQL) using browsers not encoding URL parameters before sending to server (likely Edge, not Chrome, not Firefox) are affected.

Patches

Patched by 5c395afc, included in version 4.7.9.

Workarounds

Use browser which encodes URL parameters (e.g. Chrome or Firefox).

References

https://sourceforge.net/p/adminer/bugs-and-features/775/

For more information

If you have any questions or comments about this advisory:

• Comment at https://sourceforge.net/p/adminer/bugs-and-features/775/

Permalink: https://github.com/advisories/GHSA-9pgx-gcph-mpqr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlwZ3gtZ2NwaC1tcHFy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 4 years ago
Updated: over 1 year ago

CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Percentage: 0.00135
EPSS Percentile: 0.49543

Identifiers: GHSA-9pgx-gcph-mpqr, CVE-2020-35572
References:

• https://github.com/vrana/adminer/security/advisories/GHSA-9pgx-gcph-mpqr
• https://nvd.nist.gov/vuln/detail/CVE-2020-35572
• https://github.com/vrana/adminer/commit/5c395afc098e501be3417017c6421968aac477bd
• https://sourceforge.net/p/adminer/bugs-and-features/775/
• https://sourceforge.net/p/adminer/news/2021/02/adminer-479-released/
• https://github.com/advisories/GHSA-9pgx-gcph-mpqr

Repository: https://github.com/vrana/adminer
Blast Radius: 12.0

Affected Packages