Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942.

The remote host is affected by the vulnerability described in GLSA-200903-32 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in phpMyAdmin:
    libraries/database_interface.lib.php in phpMyAdmin allows remote     authenticated users to execute arbitrary code via a request to     server_databases.php with a sort_by parameter containing PHP sequences,     which are processed by create_function (CVE-2008-4096).
    Cross-site scripting (XSS) vulnerability in pmd_pdf.php allows remote     attackers to inject arbitrary web script or HTML via the db parameter,     a different vector than CVE-2006-6942 and CVE-2007-5977     (CVE-2008-4775).
    Cross-site request forgery (CSRF) vulnerability in phpMyAdmin allows     remote authenticated attackers to perform unauthorized actions as the     administrator via a link or IMG tag to tbl_structure.php with a     modified table parameter. NOTE: this can be leveraged to conduct SQL     injection attacks and execute arbitrary code (CVE-2008-5621).
    Multiple cross-site request forgery (CSRF) vulnerabilities in     phpMyAdmin allow remote attackers to conduct SQL injection attacks via     unknown vectors related to the table parameter, a different vector than     CVE-2008-5621 (CVE-2008-5622).
  Impact :

    A remote attacker may execute arbitrary code with the rights of the     webserver, inject and execute SQL with the rights of phpMyAdmin or     conduct XSS attacks against other users.
  Workaround :

    There is no known workaround at this time.

The login page (auth_type cookie) was vulnerable to XSS via the convcharset parameter (PMASA-2007-8).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Nov 20 2007 Mike McGrath <mmcgrath at redhat.com>     2.11.2.1-1

    - Upstream released new version

    - Mon Oct 29 2007 Mike McGrath <mmcgrath at redhat.com>       2.11.2-1

    - upstream released new version

    - Mon Oct 22 2007 Mike McGrath <mmcgrath at redhat.com>       2.11.1.2-1

    - upstream released new version

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Nov 20 2007 Mike McGrath <mmcgrath at redhat.com>     2.11.2.1-1

    - Upstream released new version

    - Mon Oct 29 2007 Mike McGrath <mmcgrath at redhat.com>       2.11.2-1

    - upstream released new version

    - Mon Oct 22 2007 Mike McGrath <mmcgrath at redhat.com>       2.11.1.2-1

    - upstream released new version

    - Thu Sep 6 2007 Mike McGrath <mmcgrath at redhat.com>       2.11.0-1

    - Upstream released new version

    - Altered sources file as required

    - Added proper license

    - Mon Jul 23 2007 Mike McGrath <mmcgrath at redhat.com>       2.10.3-1

    - Upstream released new version

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The DigiTrust Group reports :

When creating a new database, a malicious user can use a client-side Web proxy to place malicious code in the db parameter of the POST request. Since db_create.php does not properly sanitize user-supplied input, an administrator could face a persistent XSS attack when the database names are displayed.

ID	Name	Product	Family	Severity
35964	GLSA-200903-32 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
28311	Fedora 7 : phpMyAdmin-2.11.2.2-1.fc7 (2007-3666)	Nessus	Fedora Local Security Checks	medium
28310	Fedora 8 : phpMyAdmin-2.11.2.2-1.fc8 (2007-3639)	Nessus	Fedora Local Security Checks	medium
28309	Fedora 8 : phpMyAdmin-2.11.2.1-1.fc8 (2007-3636)	Nessus	Fedora Local Security Checks	medium
28308	Fedora 7 : phpMyAdmin-2.11.2.1-1.fc7 (2007-3627)	Nessus	Fedora Local Security Checks	medium
28165	FreeBSD : phpmyadmin -- XSS vulnerability (2d2dcbb4-906c-11dc-a951-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2007-5977

medium

Tenable Plugins

high

medium

medium

medium

medium

medium