phpMyAdmin Prior to 3.4.8 Multiple Cross Site Scripting Vulnerabilities
BID:51099
Info
phpMyAdmin Prior to 3.4.8 Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 51099 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-4634 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 16 2011 12:00AM |
| Updated: | Apr 16 2015 06:04PM |
| Credit: | David Vieira-Kurz, Maxim Rupp and R.Harikrishnan |
| Vulnerable: |
phpMyAdmin phpMyAdmin 3.4.6 phpMyAdmin phpMyAdmin 3.4.5 phpMyAdmin phpMyAdmin 3.4.3 phpMyAdmin phpMyAdmin 3.4.5 phpMyAdmin phpMyAdmin 3.4.4 phpMyAdmin phpMyAdmin 3.4.3.2 phpMyAdmin phpMyAdmin 3.4.3.1 phpMyAdmin phpMyAdmin 3.4.1 phpMyAdmin phpMyAdmin 3.4.0-beta1 phpMyAdmin phpMyAdmin 3.4.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux |
| Not Vulnerable: |
phpMyAdmin phpMyAdmin 3.4.8 |
Discussion
phpMyAdmin Prior to 3.4.8 Multiple Cross Site Scripting Vulnerabilities
phpMyAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
phpMyAdmin versions prior to 3.4.8 are vulnerable.
phpMyAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
phpMyAdmin versions prior to 3.4.8 are vulnerable.
Exploit / POC
phpMyAdmin Prior to 3.4.8 Multiple Cross Site Scripting Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.
To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
phpMyAdmin Prior to 3.4.8 Multiple Cross Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
MandrakeSoft Enterprise Server 5
MandrakeSoft Enterprise Server 5 x86_64
Solution:
Updates are available. Please see the references for more information.
MandrakeSoft Enterprise Server 5
-
Mandriva phpmyadmin-3.4.9-0.1mdvmes5.2.noarch.rpm
http://www.mandriva.com/en/downloads/
MandrakeSoft Enterprise Server 5 x86_64
-
Mandriva phpmyadmin-3.4.9-0.1mdvmes5.2.noarch.rpm
http://www.mandriva.com/en/downloads/
References
phpMyAdmin Prior to 3.4.8 Multiple Cross Site Scripting Vulnerabilities
References:
References:
- phpMyAdmin Homepage (phpMyAdmin)
- Bug 767666 - (CVE-2011-4634) CVE-2011-4634 phpMyAdmin: multiple XSS flaws (PMASA (Red Hat)
- PMASA-2011-18 phpMyAdmin: multiple XSS flaws (phpMyAdmin)