CVE-2022-23808

Deeper analysis

CVE-2022-23808 is a cross-site scripting vulnerability affecting phpMyAdmin versions 5.1 prior to 5.1.2. The flaw resides in the setup script, where insufficient input sanitization allows an attacker to inject malicious code that results in XSS or HTML injection, as classified under CWE-79. The issue carries a CVSS 3.1 base score of 6.1 with network attack vector, low complexity, no required privileges, required user interaction, and changed scope.

An unauthenticated remote attacker can exploit the vulnerability by crafting a malicious request that triggers the setup script, causing the injected code to execute in a victim's browser session. Successful exploitation can lead to limited impacts on confidentiality and integrity, such as session hijacking or unauthorized actions within the affected phpMyAdmin instance.

The official phpMyAdmin security announcement PMASA-2022-2 and the Gentoo GLSA 202311-17 both recommend upgrading to version 5.1.2 or later to remediate the issue, with no additional workarounds specified beyond patching.

The EPSS score for this CVE rose from lower values after disclosure to a peak of 0.6841 on 2025-12-11 before receding to the current 0.4936, indicating increased exploitation interest emerged well after the initial publication.