Missing sanitization on the table, column and index names leads to XSS vulnerabilities, see PMASA-2011-13

2011-08-19 11:48:57 +02:00
parent a5716cb389
commit c79375598d
2 changed files with 4 additions and 1 deletions
--- a/db_datadict.php
+++ b/db_datadict.php
@@ -70,7 +70,7 @@ while ($row = PMA_DBI_fetch_assoc($rowset)) {
        echo '<div>' . "\n";
    }

-    echo '<h2>' . $table . '</h2>' . "\n";
+    echo '<h2>' . htmlspecialchars($table) . '</h2>' . "\n";

    /**
     * Gets table informations