OSVDB ID: 84872

Title: phpMyAdmin Database Structure Table Name Empty / Drop Link XSS

Info

Disclosure
Aug 16, 2012

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Aug 16, 2012

Description

 phpMyAdmin contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate table names when using the empty or drop links on the database structure page. This may allow a user to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS, Upgrade
Exploit: Exploit Public
Disclosure: Vendor Verified
OSVDB: Authentication Required, Web Related

Solution

 Upgrade to version 3.4.11.1 or 3.5.2.2 or higher, as they have been reported to fix this vulnerability. In addition, the vendor has released a patch for some older versions.

Products

phpMyAdmin Devel Team

phpMyAdmin

 3.5.2.1
3.5.2.0
3.5.0.0
3.5.1.0
3.4.11
3.4.10.2
3.4.10.1
3.4.7.1
3.4.3.2
3.4.3.1
3.4.1.0
3.4.0.0
3.4.2.0
3.4.3.0
3.4.4.0
3.4.5.0
3.4.7.0
3.4.8.0
3.4.6.0
3.4.9.01
3.4.10.0

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/84872