Multiple cross-site scripting (XSS) vulnerabilities in libraries/display_export.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the (1) server, (2) database, and (3) table sections.

- update to 3.4.9

  - bug #3442028 [edit] Inline editing enum fields with null     shows no dropdown

  - bug #3442004 [interface] DB suggestion not correct for     user with underscore

  - bug #3438420 [core] Magic quotes removed in PHP 5.4

  - bug #3398788 [session] No feedback when result is empty     (signon auth_type)

  - bug #3384035 [display] Problems regarding     ShowTooltipAliasTB

  - bug #3306875 [edit] Can't rename a database that     contains views

  - bug #3452506 [edit] Unable to move tables with triggers

  - bug #3449659 [navi] Fast filter broken with table tree

  - bug #3448485 [GUI] Firefox favicon frameset regression

  - [core] Better compatibility with mysql extension

  - [security] Self-XSS on export options (export     server/database/table), see PMASA-2011-20

  - [security] Self-XSS in setup (host parameter), see     PMASA-2011-19

  - fix for bnc#738411

  - PMASA-2011-19 (CVE-2011-4780)

  - PMASA-2011-20 (CVE-2011-4782)

  - rework config patch

The remote host is affected by the vulnerability described in GLSA-201201-01 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in phpMyAdmin. Please       review the CVE identifiers and phpMyAdmin Security Advisories referenced       below for details.
  Impact :

    Remote attackers might be able to insert and execute PHP code, include       and execute local PHP files, or perform Cross-Site Scripting (XSS)       attacks via various vectors.
  Workaround :

    There is no known workaround at this time.

Changes 3.4.9.0 (2011-12-21) :

  - [edit] Inline editing enum fields with null shows no     dropdown

    - [interface] DB suggestion not correct for user with       underscore

    - [core] Magic quotes removed in PHP 5.4

    - [session] No feedback when result is empty (signon       auth_type)

    - [display] Problems regarding ShowTooltipAliasTB

    - [edit] Can't rename a database that contains views

    - [edit] Unable to move tables with triggers

    - [navi] Fast filter broken with table tree

    - [GUI] Firefox favicon frameset regression

    - [core] Better compatibility with mysql extension

    - [security] Self-XSS on export options (export       server/database/table), see PMASA-2011-20       (http://www.phpmyadmin.net/home_page/security/PMASA-20       11-20.php)

    - [security] Self-XSS in setup (host parameter), see       PMASA-2011-19       (http://www.phpmyadmin.net/home_page/security/PMASA-20       11-19.php)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The phpMyAdmin development team reports :

Using crafted url parameters, it was possible to produce XSS on the export panels in the server, database and table sections.

Crafted values entered in the setup interface can produce XSS; also, if the config directory exists and is writeable, the XSS payload can be saved to this directory.

The version of phpMyAdmin hosted on the remote web server is 3.4.x less than 3.4.9 and thus is reportedly affected by two cross-site scripting vulnerabilities :

  - The 'libraries/display_export.lib.php' script does not     properly sanitize the '$_GET' array elements     'limit_to', 'limit_from' and 'filename_template'     before returning it to the client. (CVE-2011-4780)

  - The 'libraries/config/ConfigFile.class.php' script does     not properly sanitize input in the '$host' parameter     before returning it to the client. Note that this issue     relates to the '/setup' directory and configuration of     the application and should not be exploitable if the     recommended installation steps have been performed.
    (CVE-2011-4782)

ID	Name	Product	Family	Severity
74585	openSUSE Security Update : phpMyAdmin (openSUSE-2012-18)	Nessus	SuSE Local Security Checks	medium
57433	GLSA-201201-01 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
57424	Fedora 15 : phpMyAdmin-3.4.9-1.fc15 (2011-17370)	Nessus	Fedora Local Security Checks	medium
57423	Fedora 16 : phpMyAdmin-3.4.9-1.fc16 (2011-17369)	Nessus	Fedora Local Security Checks	medium
57390	FreeBSD : phpMyAdmin -- Multiple XSS (8c83145d-2c95-11e1-89b4-001ec9578670)	Nessus	FreeBSD Local Security Checks	medium
57372	phpMyAdmin 3.4.x < 3.4.9 XSS (PMASA-2011-19 - PMASA-2011-20)	Nessus	CGI abuses : XSS	medium

Detections

Analytics

CVE-2011-4780

medium

Tenable Plugins

medium

critical

medium

medium

medium

medium