CVE-2022-23808

MEDIUMNuclei

Cross-site Scripting in phpmyadmin

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-23808 has a selected CVSS score of 6.1 (medium); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

phpmyadmin/phpmyadmin

Browse Packagist / phpmyadmin/phpmyadmin
GitHub Advisory5.1.0 to < 5.1.2 · Fixed in 5.1.2affected

Proofs of concept

1

Repository PoCs

GitHubdipakpanchal05/CVE-2022-23808Repository PoCby dipakpanchal05114Not analyzed1 file

2.2 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMphpMyAdmin < 5.1.2 - Cross-Site ScriptingCVSS 6.1

An issue was discovered in phpMyAdmin 5.1 before 5.1.2 that could allow an attacker to inject malicious code into aspects of the setup script, which can allow cross-site or HTML injection.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the targeted user's browser, potentially leading to session hijacking, data theft, or other malicious activities.

Remediation

Upgrade phpMyAdmin to version 5.1.2 or later to mitigate this vulnerability.

WeaknessesCWE-79
Authorscckuailong, daffainfo
Template tagscvecve2022phpmyadminxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*
Shodan: http.component:"phpmyadmin"
Shodan: http.title:"phpmyadmin"
Shodan: cpe:"cpe:2.3:a:phpmyadmin:phpmyadmin"
FOFA: title="phpmyadmin"
FOFA: body="pma_servername" && body="4.8.4"
Google: intitle:"phpmyadmin"
https://mp.weixin.qq.com/s/c2kwxwVUn1ym7oqv9Uio_A https://github.com/dipakpanchal456/CVE-2022-23808 https://nvd.nist.gov/vuln/detail/CVE-2022-23808 https://www.phpmyadmin.net/security/PMASA-2022-2/ https://infosecwriteups.com/exploit-cve-2022-23808-85041c6e5b97

Source: ProjectDiscovery

References

7