Updated phpmyadmin package fixes security vulnerability :

In phpMyAdmin before 4.2.9, by deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micro history feature (CVE-2014-6300).

phpMyAdmin 4.2.8.1 (2014-09-13) ===============================

  - [security] DOM based XSS that results to a CSRF that     creates a ROOT account in certain conditions

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

phpMyAdmin was updated to 4.1.14.4 (2014-09-13) fixing bugs and security issues.

  - PMASA-2014-10 (CVE-2014-6300, CWE-661 CWE-352)     http://www.phpmyadmin.net/home_page/security/PMASA-2014-     10.php

    A DOM based XSS was fixed that resulted to a CSRF that     creates a ROOT account in certain conditions.

The phpMyAdmin development team reports :

XSRF/CSRF due to DOM based XSS in the micro history feature.

By deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micro history feature.

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.3, 4.1.x prior to 4.1.14.4, or 4.2.x prior to 4.2.8.1. It is, therefore, affected by an input-validation error related to the 'micro history' feature that could allow a DOM-based cross-site scripting attack that could further lead to cross-site request forgery attacks.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201505-03 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in phpMyAdmin.  Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote authenticated attacker could exploit these vulnerabilities to       include and execute arbitrary local files via a crafted parameter, inject       SQL code, or to conduct Cross-Site Scripting attacks.
  Workaround :

    There is no known workaround at this time.

Versions of phpMyAdmin earlier than 4.0.10.3, 4.1.14.4, or 4.2.8.1 are unpatched for a DOM-based cross-site scripting vulnerability in the micro-history feature that could be leveraged for cross-site request forgery -- that is, by deceiving a logged-in user to click on a crafted URL, an attacker could perform remote code execution and in some cases, create a root account, via the user's account.

ID	Name	Product	Family	Published	Updated	Severity
77840	Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2014:183)	Nessus	Mandriva Local Security Checks	9/25/2014	1/6/2021	medium
77873	Fedora 19 : phpMyAdmin-4.2.8.1-2.fc19 (2014-10989)	Nessus	Fedora Local Security Checks	9/26/2014	1/11/2021	medium
77804	openSUSE Security Update : phpMyAdmin (openSUSE-SU-2014:1150-1)	Nessus	SuSE Local Security Checks	9/23/2014	1/19/2021	medium
77679	FreeBSD : phpMyAdmin -- XSRF/CSRF due to DOM based XSS in the micro history feature (cc627e6c-3b89-11e4-b629-6805ca0b3d42)	Nessus	FreeBSD Local Security Checks	9/15/2014	1/6/2021	medium
77702	phpMyAdmin 4.0.x < 4.0.10.3 / 4.1.x < 4.1.14.4 / 4.2.x < 4.2.8.1 Micro History XSS and XSRF Vulnerabilities (PMASA-2014-10)	Nessus	CGI abuses	9/16/2014	6/4/2024	medium
77872	Fedora 20 : phpMyAdmin-4.2.8.1-2.fc20 (2014-10981)	Nessus	Fedora Local Security Checks	9/26/2014	1/11/2021	medium
83912	GLSA-201505-03 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	6/1/2015	1/11/2021	medium
77797	Fedora 21 : phpMyAdmin-4.2.8.1-2.fc21 (2014-10885)	Nessus	Fedora Local Security Checks	9/23/2014	1/11/2021	medium
8409	phpMyAdmin 4.0.x < 4.0.10.3, 4.1.x < 4.1.14.4, 4.2.x < 4.2.8.1 CSRF (PMASA-2014-10)	Nessus Network Monitor	CGI	10/2/2014	3/6/2019	low

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

low