Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js.

The remote host is affected by the vulnerability described in GLSA-201505-03 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in phpMyAdmin.  Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote authenticated attacker could exploit these vulnerabilities to       include and execute arbitrary local files via a crafted parameter, inject       SQL code, or to conduct Cross-Site Scripting attacks.
  Workaround :

    There is no known workaround at this time.

Versions of phpMyAdmin earlier than 4.0.10.3, 4.1.14.4, or 4.2.8.1 are unpatched for a DOM-based cross-site scripting vulnerability in the micro-history feature that could be leveraged for cross-site request forgery -- that is, by deceiving a logged-in user to click on a crafted URL, an attacker could perform remote code execution and in some cases, create a root account, via the user's account.

phpMyAdmin 4.2.8.1 (2014-09-13) ===============================

  - [security] DOM based XSS that results to a CSRF that     creates a ROOT account in certain conditions

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated phpmyadmin package fixes security vulnerability :

In phpMyAdmin before 4.2.9, by deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micro history feature (CVE-2014-6300).

phpMyAdmin was updated to 4.1.14.4 (2014-09-13) fixing bugs and security issues.

  - PMASA-2014-10 (CVE-2014-6300, CWE-661 CWE-352)     http://www.phpmyadmin.net/home_page/security/PMASA-2014-     10.php

    A DOM based XSS was fixed that resulted to a CSRF that     creates a ROOT account in certain conditions.

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.3, 4.1.x prior to 4.1.14.4, or 4.2.x prior to 4.2.8.1. It is, therefore, affected by an input-validation error related to the 'micro history' feature that could allow a DOM-based cross-site scripting attack that could further lead to cross-site request forgery attacks.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The phpMyAdmin development team reports :

XSRF/CSRF due to DOM based XSS in the micro history feature.

By deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micro history feature.

ID	Name	Product	Family	Severity
83912	GLSA-201505-03 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
8409	phpMyAdmin 4.0.x < 4.0.10.3, 4.1.x < 4.1.14.4, 4.2.x < 4.2.8.1 CSRF (PMASA-2014-10)	Nessus Network Monitor	CGI	low
77873	Fedora 19 : phpMyAdmin-4.2.8.1-2.fc19 (2014-10989)	Nessus	Fedora Local Security Checks	medium
77872	Fedora 20 : phpMyAdmin-4.2.8.1-2.fc20 (2014-10981)	Nessus	Fedora Local Security Checks	medium
77840	Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2014:183)	Nessus	Mandriva Local Security Checks	medium
77804	openSUSE Security Update : phpMyAdmin (openSUSE-SU-2014:1150-1)	Nessus	SuSE Local Security Checks	medium
77797	Fedora 21 : phpMyAdmin-4.2.8.1-2.fc21 (2014-10885)	Nessus	Fedora Local Security Checks	medium
77702	phpMyAdmin 4.0.x < 4.0.10.3 / 4.1.x < 4.1.14.4 / 4.2.x < 4.2.8.1 Micro History XSS and XSRF Vulnerabilities (PMASA-2014-10)	Nessus	CGI abuses	medium
77679	FreeBSD : phpMyAdmin -- XSRF/CSRF due to DOM based XSS in the micro history feature (cc627e6c-3b89-11e4-b629-6805ca0b3d42)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2014-6300

high

Tenable Plugins

medium

low

medium

medium

medium

medium

medium

medium

medium