phpMyAdmin Setup Interface Cross Site Scripting Vulnerability

Bugtraq ID:	50175
Class:	Input Validation Error
CVE:	CVE-2011-4064
Remote:	Yes
Local:	No
Published:	Oct 17 2011 12:00AM
Updated:	Apr 13 2015 09:37PM
Credit:	Jakub Galczyk
Vulnerable:	Typo3 Typo3 4.5.5 Typo3 Typo3 4.4.11 Typo3 Typo3 4.4.1 Typo3 Typo3 4.4 Typo3 Typo3 4.3.3 Typo3 Typo3 4.3.2 Typo3 Typo3 4.3.1 Typo3 Typo3 4.3 Typo3 Typo3 4.2.12 Typo3 Typo3 4.2.11 Typo3 Typo3 4.2.10 Typo3 Typo3 4.2.9 Typo3 Typo3 4.2.6 Typo3 Typo3 4.2.4 Typo3 Typo3 4.2.3 Typo3 Typo3 4.2.2 Typo3 Typo3 4.2.1 Typo3 Typo3 4.2 Typo3 Typo3 4.1.14 Typo3 Typo3 4.1.13 Typo3 Typo3 4.1.12 Typo3 Typo3 4.1.10 Typo3 Typo3 4.1.8 Typo3 Typo3 4.1.7 Typo3 Typo3 4.1.6 Typo3 Typo3 4.1.4 Typo3 Typo3 4.1 Typo3 Typo3 4.5.6 Typo3 Typo3 4.5.4 Typo3 Typo3 4.5.3 Typo3 Typo3 4.5.2 Typo3 Typo3 4.5.1 Typo3 Typo3 4.5 Typo3 Typo3 4.4.9 Typo3 Typo3 4.4.8 Typo3 Typo3 4.4.5 Typo3 Typo3 4.4.4 Typo3 Typo3 4.4.4 Typo3 Typo3 4.4.3 Typo3 Typo3 4.4.11 Typo3 Typo3 4.3beta2 Typo3 Typo3 4.3.9 Typo3 Typo3 4.3.7 Typo3 Typo3 4.3.6 Typo3 Typo3 4.3.4 Typo3 Typo3 4.3.14 Typo3 Typo3 4.3.12 Typo3 Typo3 4.3.11 Typo3 Typo3 4.3.0beta1 Typo3 Typo3 4.2.16 Typo3 Typo3 4.2.15 Typo3 Typo3 4.2.14 Typo3 Typo3 4.2.13 Typo3 Typo3 4.1beta phpMyAdmin phpMyAdmin 3.4.3 phpMyAdmin phpMyAdmin 3.3.8 phpMyAdmin phpMyAdmin 3.3.7 phpMyAdmin phpMyAdmin 3.3.6 phpMyAdmin phpMyAdmin 3.3.5 phpMyAdmin phpMyAdmin 3.3.3 0 phpMyAdmin phpMyAdmin 3.2.2 .1 phpMyAdmin phpMyAdmin 3.2.2 phpMyAdmin phpMyAdmin 3.2.1 phpMyAdmin phpMyAdmin 3.2 phpMyAdmin phpMyAdmin 3.1.5 phpMyAdmin phpMyAdmin 3.1.4 phpMyAdmin phpMyAdmin 3.1.3 phpMyAdmin phpMyAdmin 3.1.1 0 phpMyAdmin phpMyAdmin 3.1.1 .1 phpMyAdmin phpMyAdmin 3.1 .0 phpMyAdmin phpMyAdmin 3.1 phpMyAdmin phpMyAdmin 3.0.1 phpMyAdmin phpMyAdmin 3.0 RC1 phpMyAdmin phpMyAdmin 3.0 beta phpMyAdmin phpMyAdmin 3.0 alpha phpMyAdmin phpMyAdmin 3.0 phpMyAdmin phpMyAdmin 3.4.5 phpMyAdmin phpMyAdmin 3.4.4 phpMyAdmin phpMyAdmin 3.4.3.2 phpMyAdmin phpMyAdmin 3.4.3.1 phpMyAdmin phpMyAdmin 3.4.1 phpMyAdmin phpMyAdmin 3.4.0-beta1 phpMyAdmin phpMyAdmin 3.4.0 phpMyAdmin phpMyAdmin 3.3.9.2 phpMyAdmin phpMyAdmin 3.3.8.1 phpMyAdmin phpMyAdmin 3.3.6 phpMyAdmin phpMyAdmin 3.3.5.1 phpMyAdmin phpMyAdmin 3.3.5.0 phpMyAdmin phpMyAdmin 3.3.4.0 phpMyAdmin phpMyAdmin 3.3.2.0 phpMyAdmin phpMyAdmin 3.3.10.4 phpMyAdmin phpMyAdmin 3.3.10.3 phpMyAdmin phpMyAdmin 3.3.10.2 phpMyAdmin phpMyAdmin 3.3.10.1 phpMyAdmin phpMyAdmin 3.3.1.0 phpMyAdmin phpMyAdmin 3.3.0.0 phpMyAdmin phpMyAdmin 3.3.0-dev phpMyAdmin phpMyAdmin 3.2.2 Rc1 phpMyAdmin phpMyAdmin 3.2.1-dev phpMyAdmin phpMyAdmin 3.2.1 Rc1 phpMyAdmin phpMyAdmin 3.2.0.1 phpMyAdmin phpMyAdmin 3.2.0-rc1 phpMyAdmin phpMyAdmin 3.2.0 Beta1 phpMyAdmin phpMyAdmin 3.1.5 Rc1 phpMyAdmin phpMyAdmin 3.1.4 Rc2 phpMyAdmin phpMyAdmin 3.1.3.2 phpMyAdmin phpMyAdmin 3.1.3.1 phpMyAdmin phpMyAdmin 3.1.3 Rc1 phpMyAdmin phpMyAdmin 3.1.2 Rc1 phpMyAdmin phpMyAdmin 3.1.2 phpMyAdmin phpMyAdmin 3.1.1 Rc1 phpMyAdmin phpMyAdmin 3.1.1 phpMyAdmin phpMyAdmin 3.1.0 Beta1 phpMyAdmin phpMyAdmin 3.0.1.1 phpMyAdmin phpMyAdmin 3.0.1 Rc1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux
Not Vulnerable:	Typo3 Typo3 4.11.5 phpMyAdmin phpMyAdmin 3.4.6

phpMyAdmin Setup Interface Cross Site Scripting Vulnerability

phpMyAdmin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to phpMyAdmin 3.4.6 are vulnerable.

phpMyAdmin Setup Interface Cross Site Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to follow a malicious URI.

phpMyAdmin Setup Interface Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.


MandrakeSoft Enterprise Server 5 x86_64

• Mandriva phpmyadmin-3.4.6-0.1mdvmes5.2.noarch.rpm
  http://www.mandriva.com/en/downloads/

MandrakeSoft Enterprise Server 5

• Mandriva phpmyadmin-3.4.6-0.1mdvmes5.2.noarch.rpm
  http://www.mandriva.com/en/downloads/

phpMyAdmin Setup Interface Cross Site Scripting Vulnerability

References:

• phpMyAdmin Homepage (phpMyAdmin)
  
• PMASA-2011-16 (phpMyAdmin)