Changes for 3.3.9.1 (2011-02-08)

  - [security] Path disclosure, see PMASA-2011-1

    -       http://www.phpmyadmin.net/home_page/security/PMASA-201       1-1.php

Changes for 3.3.9.2 (2011-02-11)

  - [security] SQL injection, see PMASA-2011-2

    -       http://www.phpmyadmin.net/home_page/security/PMASA-201       1-2.php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201201-01 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in phpMyAdmin. Please       review the CVE identifiers and phpMyAdmin Security Advisories referenced       below for details.
  Impact :

    Remote attackers might be able to insert and execute PHP code, include       and execute local PHP files, or perform Cross-Site Scripting (XSS)       attacks via various vectors.
  Workaround :

    There is no known workaround at this time.

According to its self-identified version number, the phpMyAdmin install hosted on the remote web server allows creation of bookmarked SQL queries which could be unintentionally executed by other users. 

Note that successful exploitation of this vulnerability requires that phpMyAdmin configuration storage is set up and enabled and that the application's bookmarks feature is enabled.

It was discovered that phpMyAdmin, a tool to administer MySQL over the web, when the bookmarks feature is enabled, allowed to create a bookmarked query which would be executed unintentionally by other users.

Versions of phpMyAdmin earlier than 2.11.11.3 / 3.3.9.2 are potentially affected by a SQL-injection vulnerability, because the application makes it possible to create a bookmark which would be executed unintentionally by other users.

ID	Name	Product	Family	Published	Updated	Severity
52465	Fedora 14 : phpMyAdmin-3.3.9.2-1.fc14 (2011-1408)	Nessus	Fedora Local Security Checks	3/1/2011	1/11/2021	medium
57433	GLSA-201201-01 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/5/2012	1/6/2021	critical
52514	Fedora 15 : phpMyAdmin-3.3.9.2-1.fc15 (2011-1282)	Nessus	Fedora Local Security Checks	3/3/2011	1/11/2021	medium
59244	phpMyAdmin 2.11.x / 3.3.x < 2.11.11.3 / 3.3.9.2 SQL Query Bookmarks Arbitrary SQL Query Execution (PMASA-2011-02)	Nessus	CGI abuses	5/23/2012	4/11/2022	medium
52030	Debian DSA-2167-1 : phpmyadmin - SQL injection	Nessus	Debian Local Security Checks	2/20/2011	1/4/2021	medium
52464	Fedora 13 : phpMyAdmin-3.3.9.2-1.fc13 (2011-1373)	Nessus	Fedora Local Security Checks	3/1/2011	1/11/2021	medium
5797	phpMyAdmin 2.x < 2.11.11.3 / 3.x < 3.3.9.2 SQLi (PMASA-2011-2)	Nessus Network Monitor	CGI	2/15/2011	3/6/2019	medium

Detections

Analytics

Plugins Search

medium

critical

medium

medium

medium

medium

medium