Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the Username to libraries/auth/cookie.auth.lib.php or (2) the error parameter to error.php.

Several cross-site scripting vulnerabilities have been discovered in phpmyadmin, a set of PHP-scripts to administrate MySQL over the WWW.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-2869     Andreas Kerber and Michal Cihar discovered several     cross-site scripting vulnerabilities in the error page     and in the cookie login.

  - CVE-2005-3300     Stefan Esser discovered missing safety checks in     grab_globals.php that could allow an attacker to induce     phpmyadmin to include an arbitrary local file.

  - CVE-2005-3301     Tobias Klein discovered several cross-site scripting     vulnerabilities that could allow attackers to inject     arbitrary HTML or client-side scripting.

The version in the old stable distribution (woody) has probably its own flaws and is not easily fixable without a full audit and patch session. The easier way is to upgrade it from woody to sarge.

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.8.  Mac OS X 10.4.8 contains several security fixes for the following programs :
 - CFNetwork
 - Flash Player
 - ImageIO
 - Kernel
 - LoginWindow
 - Preferences
 - QuickDraw Manager
 - SASL
 - WebCore
 - Workgroup Manager

Versions of phpMyAdmin prior to 2.6.4-pl3 contain a flaw that allows attackers to read arbitrary files because of its failure to sanitize the parameter 'usesubform' before using it in several scripts.

The version of phpMyAdmin installed on the remote host may suffer from two cross-site scripting vulnerabilities due to its failure to sanitize user input to the 'error' parameter of the 'error.php' script and in 'libraries/auth/cookie.auth.lib.php'.  A remote attacker may use these vulnerabilities to cause arbitrary HTML and script code to be executed in a user's browser within the context of the affected application.  

According to its banner, the version of phpMyAdmin installed on the remote host may suffer from two cross-site scripting vulnerabilities due to its failure to sanitize user input to the 'error' parameter of the 'error.php' script and in 'libraries/auth/cookie.auth.lib.php'.  A remote attacker may use these vulnerabilities to cause arbitrary HTML and script code to be executed in a user's browser within the context of the affected application.

ID	Name	Product	Family	Severity
22746	Debian DSA-880-1 : phpmyadmin - several vulnerabilities	Nessus	Debian Local Security Checks	medium
3757	Mac OS X < 10.4.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
3252	phpMyAdmin < 2.6.4-pl3 'usesubform' Parameter Remote File Inclusion	Nessus Network Monitor	CGI	medium
3193	phpMyAdmin < 2.6.4-RC1 XSS (deprecated)	Nessus Network Monitor	CGI	low
19519	phpMyAdmin < 2.6.4 Multiple XSS	Nessus	CGI abuses : XSS	medium

Detections

Analytics

CVE-2005-2869

medium

Tenable Plugins

medium

medium

medium

low

medium