phpMyAdmin Error Page Cross Site Scripting Vulnerability

Bugtraq ID:	45633
Class:	Input Validation Error
CVE:	CVE-2010-4480
Remote:	Yes
Local:	No
Published:	Dec 07 2010 12:00AM
Updated:	Apr 13 2015 09:54PM
Credit:	Tiger Security Team
Vulnerable:	phpMyAdmin phpMyAdmin 3.3.8 phpMyAdmin phpMyAdmin 3.3.7 phpMyAdmin phpMyAdmin 3.3.6 phpMyAdmin phpMyAdmin 3.3.5 phpMyAdmin phpMyAdmin 3.3.3 0 phpMyAdmin phpMyAdmin 3.2.2 .1 phpMyAdmin phpMyAdmin 3.2.2 phpMyAdmin phpMyAdmin 3.2.1 phpMyAdmin phpMyAdmin 3.2 phpMyAdmin phpMyAdmin 3.1.5 phpMyAdmin phpMyAdmin 3.1.4 phpMyAdmin phpMyAdmin 3.1.3 phpMyAdmin phpMyAdmin 3.1.1 0 phpMyAdmin phpMyAdmin 3.1.1 .1 phpMyAdmin phpMyAdmin 3.1 .0 phpMyAdmin phpMyAdmin 3.1 phpMyAdmin phpMyAdmin 3.0.1 phpMyAdmin phpMyAdmin 3.0 RC1 phpMyAdmin phpMyAdmin 3.0 beta phpMyAdmin phpMyAdmin 3.0 alpha phpMyAdmin phpMyAdmin 3.0 phpMyAdmin phpMyAdmin 2.11.10 phpMyAdmin phpMyAdmin 2.11.9 4 phpMyAdmin phpMyAdmin 2.11.9 .6 phpMyAdmin phpMyAdmin 2.11.9 .2 phpMyAdmin phpMyAdmin 2.11.9 .1 phpMyAdmin phpMyAdmin 2.11.9 phpMyAdmin phpMyAdmin 2.11.8 phpMyAdmin phpMyAdmin 2.11.7 phpMyAdmin phpMyAdmin 2.11.5 phpMyAdmin phpMyAdmin 2.11.4 phpMyAdmin phpMyAdmin 2.11.1 phpMyAdmin phpMyAdmin 2.11 phpMyAdmin phpMyAdmin 3.3.8.1 phpMyAdmin phpMyAdmin 3.3.6 phpMyAdmin phpMyAdmin 3.3.5.1 phpMyAdmin phpMyAdmin 3.3.5.0 phpMyAdmin phpMyAdmin 3.3.4.0 phpMyAdmin phpMyAdmin 3.3.2.0 phpMyAdmin phpMyAdmin 3.3.1.0 phpMyAdmin phpMyAdmin 3.3.0.0 phpMyAdmin phpMyAdmin 3.3.0-dev phpMyAdmin phpMyAdmin 3.2.2 Rc1 phpMyAdmin phpMyAdmin 3.2.1-dev phpMyAdmin phpMyAdmin 3.2.1 Rc1 phpMyAdmin phpMyAdmin 3.2.0.1 phpMyAdmin phpMyAdmin 3.2.0-rc1 phpMyAdmin phpMyAdmin 3.2.0 Beta1 phpMyAdmin phpMyAdmin 3.1.5 Rc1 phpMyAdmin phpMyAdmin 3.1.4 Rc2 phpMyAdmin phpMyAdmin 3.1.3.2 phpMyAdmin phpMyAdmin 3.1.3.1 phpMyAdmin phpMyAdmin 3.1.3 Rc1 phpMyAdmin phpMyAdmin 3.1.2 Rc1 phpMyAdmin phpMyAdmin 3.1.2 phpMyAdmin phpMyAdmin 3.1.1 Rc1 phpMyAdmin phpMyAdmin 3.1.1 phpMyAdmin phpMyAdmin 3.1.0 Beta1 phpMyAdmin phpMyAdmin 3.0.1.1 phpMyAdmin phpMyAdmin 3.0.1 Rc1 phpMyAdmin phpMyAdmin 2.11.9.5. phpMyAdmin phpMyAdmin 2.11.9.5 phpMyAdmin phpMyAdmin 2.11.9.4 phpMyAdmin phpMyAdmin 2.11.9.3 phpMyAdmin phpMyAdmin 2.11.9.0 phpMyAdmin phpMyAdmin 2.11.8.1 phpMyAdmin phpMyAdmin 2.11.8.0 phpMyAdmin phpMyAdmin 2.11.7.12.11.7.1 phpMyAdmin phpMyAdmin 2.11.7.1 phpMyAdmin phpMyAdmin 2.11.7.0 phpMyAdmin phpMyAdmin 2.11.6.0 phpMyAdmin phpMyAdmin 2.11.5.2 phpMyAdmin phpMyAdmin 2.11.5.1 phpMyAdmin phpMyAdmin 2.11.5.0 phpMyAdmin phpMyAdmin 2.11.4.0 phpMyAdmin phpMyAdmin 2.11.3.0 phpMyAdmin phpMyAdmin 2.11.2.2 phpMyAdmin phpMyAdmin 2.11.2.1 phpMyAdmin phpMyAdmin 2.11.2.0 phpMyAdmin phpMyAdmin 2.11.10.1 phpMyAdmin phpMyAdmin 2.11.10.0 phpMyAdmin phpMyAdmin 2.11.10-dev phpMyAdmin phpMyAdmin 2.11.1.2 phpMyAdmin phpMyAdmin 2.11.1.1 phpMyAdmin phpMyAdmin 2.11.1.0 phpMyAdmin phpMyAdmin 2.11 Pardus Linux 2009 0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	phpMyAdmin phpMyAdmin 3.4.0-beta1

phpMyAdmin Error Page Cross Site Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to follow a malicious URI.

phpMyAdmin Error Page Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.


MandrakeSoft Enterprise Server 5 x86_64

• Mandriva phpmyadmin-3.3.9-0.1mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5

• Mandriva phpmyadmin-3.3.9-0.1mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/

phpMyAdmin Error Page Cross Site Scripting Vulnerability

References:

• MSA-11-0001: Customised phpMyAdmin upgraded to 2.11.11.3 and 3.3.9.2 (Moodle)
  
• phpMyAdmin Homepage (phpMyAdmin)
  
• PMASA-2010-9 Unvalidated input on error page (phpMyAdmin)