RETIRED: phpMyAdmin Multiple SQL Injection and Cross Site Scripting Vulnerabilities
BID:61493
Info
RETIRED: phpMyAdmin Multiple SQL Injection and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 61493 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 28 2013 12:00AM |
| Updated: | Aug 22 2013 06:47AM |
| Credit: | Emanuel Bronshtein, Dieter Adriaenssens and Noam Rathaus |
| Vulnerable: |
MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 |
| Not Vulnerable: | |
Discussion
RETIRED: phpMyAdmin Multiple SQL Injection and Cross Site Scripting Vulnerabilities
phpMyAdmin is prone to multiple SQL-injection and multiple cross-site scripting vulnerabilities.
Successful exploits could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
phpMyAdmin 3.5.x prior to 3.5.8.2 and 4.0.x prior to 4.0.4.2 are vulnerable.
This BID is being retired. The following individual records exist to better document the issues:
61919 phpMyAdmin CVE-2013-5001 Cross Site Scripting Vulnerability
61921 phpMyAdmin CVE-2013-4996 Multiple Cross Site Scripting Vulnerabilities
61923 phpMyAdmin CVE-2013-5003 Multiple SQL Injection Vulnerabilities
phpMyAdmin is prone to multiple SQL-injection and multiple cross-site scripting vulnerabilities.
Successful exploits could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
phpMyAdmin 3.5.x prior to 3.5.8.2 and 4.0.x prior to 4.0.4.2 are vulnerable.
This BID is being retired. The following individual records exist to better document the issues:
61919 phpMyAdmin CVE-2013-5001 Cross Site Scripting Vulnerability
61921 phpMyAdmin CVE-2013-4996 Multiple Cross Site Scripting Vulnerabilities
61923 phpMyAdmin CVE-2013-5003 Multiple SQL Injection Vulnerabilities
Exploit / POC
RETIRED: phpMyAdmin Multiple SQL Injection and Cross Site Scripting Vulnerabilities
An attacker can use a web browser to exploit SQL-injection issues. An attacker must trick a victim into following a malicious URI to exploit multiple cross-site scripting issues.
An attacker can use a web browser to exploit SQL-injection issues. An attacker must trick a victim into following a malicious URI to exploit multiple cross-site scripting issues.
Solution / Fix
RETIRED: phpMyAdmin Multiple SQL Injection and Cross Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
RETIRED: phpMyAdmin Multiple SQL Injection and Cross Site Scripting Vulnerabilities
References:
References:
- phpMyAdmin Homepage (phpMyAdmin)