From 76e8b760487139bbfba08b8a6f7fdad40a93ac57 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= <mauricio@mfauth.net>
Date: Tue, 15 Oct 2024 12:27:22 -0300
Subject: [PATCH 2/2] Fix unescaped table name when checking tables
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Maurício Meneghini Fauth <mauricio@mfauth.net>

CVE: CVE-2025-24530
Upstream-Status: Backport [https://github.com/phpmyadmin/phpmyadmin/commit/23c13a81709728089ff031e5b1c29b5e91baa6a7]

Signed-off-by: Changqing Li <changqing.li@windriver.com>
---
 libraries/classes/Table/Maintenance.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libraries/classes/Table/Maintenance.php b/libraries/classes/Table/Maintenance.php
index 9ed72ef..0247c6e 100644
--- a/libraries/classes/Table/Maintenance.php
+++ b/libraries/classes/Table/Maintenance.php
@@ -7,6 +7,7 @@ namespace PhpMyAdmin\Table;
 use PhpMyAdmin\DatabaseInterface;
 use PhpMyAdmin\Index;
 use PhpMyAdmin\Util;
+use function htmlspecialchars;
 use function implode;
 use function sprintf;
 
@@ -91,7 +92,7 @@ final class Maintenance
                 continue;
             }
 
-            $indexesProblems .= sprintf(__('Problems with indexes of table `%s`'), $table);
+            $indexesProblems .= htmlspecialchars(sprintf(__('Problems with indexes of table `%s`'), $table));
             $indexesProblems .= $check;
         }
 
-- 
2.34.1

