Typical vulnerabilities ¶

Cross-site scripting (XSS)¶

When phpMyAdmin shows a piece of user data, e.g. something inside a user's database, all html special chars have to be escaped. When this escaping is missing somewhere a malicious user might fill a database with specially crafted content to trick an other user of that database into executing something. This could for example be a piece of JavaScript code that would do any number of nasty things.

phpMyAdmin tries to escape all userdata before it is rendered into html for the browser.

Cross-site request forgery (CSRF)¶

An attacker would trick a phpMyAdmin user into clicking on a link to provoke some action in phpMyAdmin. This link could either be sent via email or some random website. If successful this the attacker would be able to perform some action with the users privileges.

To mitigate this phpMyAdmin requires a token to be sent on sensitive requests. The idea is that an attacker does not poses the currently valid token to include in the presented link.

The token is regenerated for every login, so it's generally valid only for limited time, what makes it harder for attacker to obtain valid one.

SQL injection¶

As the whole purpose of phpMyAdmin is to preform sql queries, this is not our first concern. SQL injection is sensitive to us though when it concerns the mysql control connection. This controlconnection can have additional privileges which the logged in user does not poses. E.g. access the phpMyAdmin configuration storage.

User data that is included in (administrative) queries should always be run through DatabaseInterface::escapeSring().

Brute force attack¶

phpMyAdmin on its own does not rate limit authentication attempts in any way. This is caused by need to work in stateless environment, where there is no way to protect against such kind of things.

To mitigate this, you can use Captcha or utilize external tools such as fail2ban, this is more details described in Securing your phpMyAdmin installation.