phpmyadmin
Page content
- Author: Miklos Vajna
- Vulnerable: 3.3.5-1
- Unaffected: 3.3.5.1-1haven1
Some vulnerabilities have been reported in phpMyAdmin, which can be exploited by malicious people to conduct cross-site scripting attacks.
- Input passed via the “field_str” parameter to db_search.php , the “delimiter” parameter to db_sql.php, the “sort” parameter to db_structure.php, the “db” parameter to js/messages.php, the “sort_by” parameter to server_databases.php, the “checkprivs”, “dbname”, “pred_tablename”, “selected_usr[]”, “tablename”, and “username” parameters to server_privileges.php, the “DefaultLang” parameter to setup/config.php, the “cpurge”, “goto”, “purge”, “purgekey”, “table”, and “zero_rows” parameters to sql.php, and the “fields[multi_edit][]” parameter to tbl_replace.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.
- Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.
- Bug Tracker URL: http://bugs.frugalware.org/task/4294