CVE-2013-1937

MEDIUM

phpMyAdmin < 3.5.8 - Cross-Site Scripting via visualizationSettings Parameters

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2013-1937. PoCs published by waraxe.

AI-analyzed exploit summary This exploit demonstrates a reflected XSS vulnerability in phpMyAdmin versions 3.5.0 through 3.5.7. The vulnerability arises from insufficient sanitization of user-supplied input in the 'visualizationSettings' parameter, allowing arbitrary JavaScript execution in the context of the affected site.

Description

Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is "not exploitable.

Exploits (1)

exploitdb WORKING POC VERIFIED

by waraxe · textwebappsphp

https://www.exploit-db.com/exploits/38440

View Code ZIP pw:eip

This exploit demonstrates a reflected XSS vulnerability in phpMyAdmin versions 3.5.0 through 3.5.7. The vulnerability arises from insufficient sanitization of user-supplied input in the 'visualizationSettings' parameter, allowing arbitrary JavaScript execution in the context of the affected site.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: phpMyAdmin 3.5.0 - 3.5.7

No auth needed

Prerequisites: Access to the vulnerable phpMyAdmin instance

MITRE ATT&CK

T1059.007 - JavaScript

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (12)

Core 12

Core References

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2013:144

Various Sources x_refsource_misc

http://immunityservices.blogspot.com/2019/02/cvss.html

Patch x_refsource_confirm

https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a

View Patch ZIP pw:eip

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103188.html

Exploit x_refsource_misc

http://packetstormsecurity.com/files/121205/phpMyAdmin-3.5.7-Cross-Site-Scripting.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103195.html

Third Party Advisory mailing-list x_refsource_fulldisc

http://archives.neohapsis.com/archives/fulldisclosure/2013-04/0101.html

Mailing List mailing-list x_refsource_mlist

http://openwall.com/lists/oss-security/2013/04/09/13

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103184.html

Various Sources x_refsource_confirm

http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php

Exploit x_refsource_misc

http://www.waraxe.us/advisory-102.html

Scores

CVSS v3 6.1

EPSS 0.0471

EPSS Percentile 90.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (11)

phpmyadmin/phpmyadmin 3.5.0.0

phpmyadmin/phpmyadmin 3.5.1.0

phpmyadmin/phpmyadmin 3.5.2.0

phpmyadmin/phpmyadmin 3.5.2.1

phpmyadmin/phpmyadmin 3.5.2.2

phpmyadmin/phpmyadmin 3.5.3.0

phpmyadmin/phpmyadmin 3.5.4

phpmyadmin/phpmyadmin 3.5.5

phpmyadmin/phpmyadmin 3.5.6

phpmyadmin/phpmyadmin 3.5.7 (2 CPE variants)

... and 1 more

Published Apr 16, 2013

Tracked Since Feb 18, 2026