~ / search / GHSA-9pgx-gcph-mpqr

GHSA-9pgx-gcph-mpqr

vrana/adminer via XSS in the history parameter in SQL command

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-35572

Packages

EcosystemPackageAffectedFixed in
Packagist vrana/adminer < 4.7.9 4.7.9

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Users of Adminer versions supporting SQL command (most versions, e.g. MySQL) using browsers not encoding URL parameters before sending to server (likely Edge, not Chrome, not Firefox) are affected. ### Patches Patched by 5c395afc, included in version [4.7.9](https://github.com/vrana/adminer/releases/tag/v4.7.9). ### Workarounds Use browser which encodes URL parameters (e.g. Chrome or Firefox). ### References https://sourceforge.net/p/adminer/bugs-and-features/775/ ### For more information If you have any questions or comments about this advisory: * Comment at https://sourceforge.net/p/adminer/bugs-and-features/775/

References

External links from the advisory. They lead to third-party sites.