Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-26934

CVE-2020-26934: phpMyAdmin Cross-site Scripting (XSS)

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-26934
GHSA ID
GHSA-6349-53vr-7hcr
EPSS Score
0.86856%
CWE
CWE-79
Published
5/24/2022
Updated
4/24/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
phpmyadmin/phpmyadmincomposer>= 4.9.0, < 4.9.64.9.6
phpmyadmin/phpmyadmincomposer>= 5.0.0, < 5.0.35.0.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper output encoding in the transformation feature's link generation. The commit 19df63b0365621427697edc185ff7c9c5707c523 explicitly shows that $options[1] (user-controlled transformation parameters) were being used unsanitized in an <a> tag's href attribute. The TextLinkTransformationsPlugin's applyTransformation method was the specific location where untrusted input entered the output stream without proper neutralization, matching the CVE description of XSS via crafted links in transformations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

p*pMy**min ***or* *.*.* *n* *.x ***or* *.*.* *llows XSS t*rou** t** tr*ns*orm*tion ***tur* vi* * *r**t** link.

Reasoning

T** vuln*r**ility st*ms *rom improp*r output *n*o*in* in t** tr*ns*orm*tion ***tur*'s link **n*r*tion. T** *ommit **************************************** *xpli*itly s*ows t**t $options[*] (us*r-*ontroll** tr*ns*orm*tion p*r*m*t*rs) w*r* **in* us** u