phpMyAdmin SQL Injection and Cross Site Scripting Vulnerabilities

Bugtraq ID:	36658
Class:	Input Validation Error
CVE:	CVE-2009-3697 CVE-2009-3696
Remote:	Yes
Local:	No
Published:	Oct 12 2009 12:00AM
Updated:	Oct 28 2009 07:47PM
Credit:	Quintin Russ
Vulnerable:	Typo3 phpMyAdmin 4.3 Typo3 phpMyAdmin 4.2 Typo3 phpMyAdmin 4.1.1 Typo3 phpMyAdmin 4.1 Typo3 phpMyAdmin 3.4 Typo3 phpMyAdmin 3.3 Typo3 phpMyAdmin 3.2 Typo3 phpMyAdmin 3.0.1 Typo3 phpMyAdmin 3.0 Typo3 phpMyAdmin 0.2.2 Red Hat Fedora 11 Red Hat Fedora 10 phpMyAdmin phpMyAdmin 3.2.2 phpMyAdmin phpMyAdmin 3.2.1 phpMyAdmin phpMyAdmin 3.1.1 0 phpMyAdmin phpMyAdmin 3.1.1 .1 phpMyAdmin phpMyAdmin 3.1 .0 phpMyAdmin phpMyAdmin 3.0.1 phpMyAdmin phpMyAdmin 3.0 phpMyAdmin phpMyAdmin 2.11.9 4 phpMyAdmin phpMyAdmin 2.11.9 .2 phpMyAdmin phpMyAdmin 2.11.9 .1 phpMyAdmin phpMyAdmin 2.11.9 phpMyAdmin phpMyAdmin 3.2.1-dev phpMyAdmin phpMyAdmin 3.2.0.1 phpMyAdmin phpMyAdmin 3.2.0-rc1 phpMyAdmin phpMyAdmin 3.1.3.2 phpMyAdmin phpMyAdmin 3.1.3.1 phpMyAdmin phpMyAdmin 3.0.1.1 phpMyAdmin phpMyAdmin 2.11.9.5 phpMyAdmin phpMyAdmin 2.11.9.3 Pardus Linux 2009 0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	Typo3 phpMyAdmin 4.5 phpMyAdmin phpMyAdmin 3.2.2 .1 phpMyAdmin phpMyAdmin 2.11.9 .6

phpMyAdmin SQL Injection and Cross Site Scripting Vulnerabilities

phpMyAdmin is prone to an SQL-injection issue and a cross-site scripting issue because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to phpMyAdmin 2.11.9.6 and 3.2.2.1 are affected.

phpMyAdmin SQL Injection and Cross Site Scripting Vulnerabilities

An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.

phpMyAdmin SQL Injection and Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


Debian Linux 4.0 arm

• Debian phpmyadmin_2.9.1.1-13_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-13_all.deb

Debian Linux 5.0 ia-64

• Debian phpmyadmin_2.11.8.1-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny3_all.deb

Debian Linux 4.0 powerpc

• Debian phpmyadmin_2.9.1.1-13_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-13_all.deb

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva phpmyadmin-3.2.2.1-0.1mdvmes5.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 m68k

• Debian phpmyadmin_2.9.1.1-13_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-13_all.deb

Debian Linux 5.0 alpha

• Debian phpmyadmin_2.11.8.1-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny3_all.deb

Debian Linux 5.0 ia-32

• Debian phpmyadmin_2.11.8.1-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny3_all.deb

MandrakeSoft Enterprise Server 5

• Mandriva phpmyadmin-3.2.2.1-0.1mdvmes5.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 s/390

• Debian phpmyadmin_2.11.8.1-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny3_all.deb

Debian Linux 5.0 mipsel

• Debian phpmyadmin_2.11.8.1-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny3_all.deb

Debian Linux 4.0 amd64

• Debian phpmyadmin_2.9.1.1-13_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-13_all.deb

Debian Linux 4.0 ia-32

• Debian phpmyadmin_2.9.1.1-13_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-13_all.deb

Debian Linux 5.0 hppa

• Debian phpmyadmin_2.11.8.1-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny3_all.deb

Debian Linux 4.0 hppa

• Debian phpmyadmin_2.9.1.1-13_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-13_all.deb

Debian Linux 4.0 sparc

• Debian phpmyadmin_2.9.1.1-13_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-13_all.deb

Debian Linux 4.0 s/390

• Debian phpmyadmin_2.9.1.1-13_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-13_all.deb

Debian Linux 5.0 m68k

• Debian phpmyadmin_2.11.8.1-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny3_all.deb

Debian Linux 5.0 arm

• Debian phpmyadmin_2.11.8.1-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny3_all.deb

Debian Linux 4.0 alpha

• Debian phpmyadmin_2.9.1.1-13_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-13_all.deb

Debian Linux 4.0 armel

• Debian phpmyadmin_2.9.1.1-13_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-13_all.deb

Debian Linux 5.0 armel

• Debian phpmyadmin_2.11.8.1-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny3_all.deb

Debian Linux 5.0

• Debian phpmyadmin_2.11.8.1-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny3_all.deb

MandrakeSoft Corporate Server 4.0

• Mandriva phpMyAdmin-2.11.9.6-0.1.20060mlcs4.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0

• Debian phpmyadmin_2.9.1.1-13_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-13_all.deb

Debian Linux 4.0 mipsel

• Debian phpmyadmin_2.9.1.1-13_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-13_all.deb

Debian Linux 5.0 amd64

• Debian phpmyadmin_2.11.8.1-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny3_all.deb

Debian Linux 5.0 mips

• Debian phpmyadmin_2.11.8.1-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny3_all.deb

Debian Linux 5.0 powerpc

• Debian phpmyadmin_2.11.8.1-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny3_all.deb

Debian Linux 4.0 ia-64

• Debian phpmyadmin_2.9.1.1-13_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-13_all.deb

Debian Linux 4.0 mips

• Debian phpmyadmin_2.9.1.1-13_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-13_all.deb

Debian Linux 5.0 sparc

• Debian phpmyadmin_2.11.8.1-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny3_all.deb

Typo3 phpMyAdmin 0.2.2

• Typo3 phpmyadmin_4.5.0.t3x
  http://typo3.org/fileadmin/ter/p/h/phpmyadmin_4.5.0.t3x

Typo3 phpMyAdmin 3.0

• Typo3 phpmyadmin_4.5.0.t3x
  http://typo3.org/fileadmin/ter/p/h/phpmyadmin_4.5.0.t3x

Typo3 phpMyAdmin 3.0.1

• Typo3 phpmyadmin_4.5.0.t3x
  http://typo3.org/fileadmin/ter/p/h/phpmyadmin_4.5.0.t3x

Typo3 phpMyAdmin 3.2

• Typo3 phpmyadmin_4.5.0.t3x
  http://typo3.org/fileadmin/ter/p/h/phpmyadmin_4.5.0.t3x

Typo3 phpMyAdmin 3.3

• Typo3 phpmyadmin_4.5.0.t3x
  http://typo3.org/fileadmin/ter/p/h/phpmyadmin_4.5.0.t3x

Typo3 phpMyAdmin 3.4

• Typo3 phpmyadmin_4.5.0.t3x
  http://typo3.org/fileadmin/ter/p/h/phpmyadmin_4.5.0.t3x

MandrakeSoft Corporate Server 4.0 x86_64

• Mandriva phpMyAdmin-2.11.9.6-0.1.20060mlcs4.noarch.rpm
  http://www.mandriva.com/en/download/

Typo3 phpMyAdmin 4.1

• Typo3 phpmyadmin_4.5.0.t3x
  http://typo3.org/fileadmin/ter/p/h/phpmyadmin_4.5.0.t3x

Typo3 phpMyAdmin 4.1.1

• Typo3 phpmyadmin_4.5.0.t3x
  http://typo3.org/fileadmin/ter/p/h/phpmyadmin_4.5.0.t3x

Typo3 phpMyAdmin 4.2

• Typo3 phpmyadmin_4.5.0.t3x
  http://typo3.org/fileadmin/ter/p/h/phpmyadmin_4.5.0.t3x

Typo3 phpMyAdmin 4.3

• Typo3 phpmyadmin_4.5.0.t3x
  http://typo3.org/fileadmin/ter/p/h/phpmyadmin_4.5.0.t3x

phpMyAdmin SQL Injection and Cross Site Scripting Vulnerabilities

References:

• phpMyAdmin Extension Homepage (TYPO3)
  
• phpMyAdmin Homepage (phpMyAdmin)
  
• Version 2.11.9.6 of phpMyAdmin (phpMyAdmin)
  
• Version 3.2.2.1 of phpMyAdmin (phpMyAdmin)
  
• PMASA-2009-6 XSS and SQL injection vulnerabilities (phpMyAdmin)
  
• TYPO3 Security Bulletin TYPO3-SA-2009-015: XSS and SQL injection vulnerabilities (TYPO3)