From a8e215c314a98008aab6f3147a409911be73108e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= Date: Sun, 12 Jan 2025 22:39:06 -0300 Subject: [PATCH 1/2] Fix XSS vulnerability on Insert page MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Maurício Meneghini Fauth CVE: CVE-2025-24529 Upstream-Status: Backport [https://github.com/phpmyadmin/phpmyadmin/commit/7355ddff8d1da9453cf43c09a45666157b16103d] Signed-off-by: Changqing Li --- libraries/classes/InsertEdit.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libraries/classes/InsertEdit.php b/libraries/classes/InsertEdit.php index abc3c5f..4bde765 100644 --- a/libraries/classes/InsertEdit.php +++ b/libraries/classes/InsertEdit.php @@ -2166,8 +2166,8 @@ class InsertEdit } elseif ($trueType === 'binary' || $trueType === 'varbinary') { $special_chars = bin2hex($column['Default']); } elseif (substr($trueType, -4) === 'text') { - $textDefault = substr($column['Default'], 1, -1); - $special_chars = stripcslashes($textDefault !== false ? $textDefault : $column['Default']); + $textDefault = (string) substr($column['Default'], 1, -1); + $special_chars = htmlspecialchars(stripcslashes($textDefault !== '' ? $textDefault : $column['Default'])); } else { $special_chars = htmlspecialchars($column['Default']); } -- 2.34.1