Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and CVE-2007-5977.

The remote host is affected by the vulnerability described in GLSA-200903-32 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in phpMyAdmin:
    libraries/database_interface.lib.php in phpMyAdmin allows remote     authenticated users to execute arbitrary code via a request to     server_databases.php with a sort_by parameter containing PHP sequences,     which are processed by create_function (CVE-2008-4096).
    Cross-site scripting (XSS) vulnerability in pmd_pdf.php allows remote     attackers to inject arbitrary web script or HTML via the db parameter,     a different vector than CVE-2006-6942 and CVE-2007-5977     (CVE-2008-4775).
    Cross-site request forgery (CSRF) vulnerability in phpMyAdmin allows     remote authenticated attackers to perform unauthorized actions as the     administrator via a link or IMG tag to tbl_structure.php with a     modified table parameter. NOTE: this can be leveraged to conduct SQL     injection attacks and execute arbitrary code (CVE-2008-5621).
    Multiple cross-site request forgery (CSRF) vulnerabilities in     phpMyAdmin allow remote attackers to conduct SQL injection attacks via     unknown vectors related to the table parameter, a different vector than     CVE-2008-5621 (CVE-2008-5622).
  Impact :

    A remote attacker may execute arbitrary code with the rights of the     webserver, inject and execute SQL with the rights of phpMyAdmin or     conduct XSS attacks against other users.
  Workaround :

    There is no known workaround at this time.

SecurityFocus reports :

phpMyAdmin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This update by upstream to phpMyAdmin 3.0.1.1 solves CVE-2008-4775, a XSS issue in pmd_pdf.php via db parameter when register_globals is enabled. - [GUI] SQL error after sorting a subset - [lang] Catalan update - [lang] Russian update

  - [import] Temporary uploaded file not deleted - [auth]     Cannot create database after session timeout - [core]     ForceSSL generates incorrectly escaped redirections     (this time with the correct fix) - [lang] Hungarian     update - [core] Properly truncate SQL to avoid half of     html tags - [lang] Romanian update - [structure]     Incorrect index choice shown when modifying an index -     [interface] Misleading message after cancelling an     action - [lang] Croatian update - [lang] Finnish update
    - [lang] Polish update - [lang] Japanese update -     [privileges] Wrong message when changing password -     [core] Cannot disable PMA tables - [lang] Problems with     Italian language file - [interface] ShowChgPassword     setting not respected - [security] XSS in a Designer     component

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
35964	GLSA-200903-32 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
34686	FreeBSD : phpmyadmin -- XSS Vulnerability (85b0bbc8-a7a5-11dd-8283-001c2514716c)	Nessus	FreeBSD Local Security Checks	low
34684	Fedora 8 : phpMyAdmin-3.0.1.1-1.fc8 (2008-9336)	Nessus	Fedora Local Security Checks	low
34682	Fedora 9 : phpMyAdmin-3.0.1.1-1.fc9 (2008-9316)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2008-4775

medium

Tenable Plugins

high

low

low

low