From 2f980e9f37fad2833b7da981321ca99dec3debf3 Mon Sep 17 00:00:00 2001 From: miwi Date: Sun, 11 Nov 2007 15:52:23 +0000 Subject: - Document phpmyadmin -- cross-site scripting vulnerability Reviewed by: simon Approved by: portmgr (ports-security blanket) --- security/vuxml/vuln.xml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) (limited to 'security') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 7b117545e9fc..fb4a69fbcda5 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,36 @@ Note: Please add new entries to the beginning of this file. --> + + phpmyadmin -- cross-site scripting vulnerability + + + phpMyAdmin + 2.11.2.1 + + + + +

The DigiTrust Group reports:

+
When creating a new database, a malicious user can use a client-side + Web proxy to place malicious code in the db parameter of the POST + request. Since db_create.php does not properly sanitize user-supplied + input, an administrator could face a persistent XSS attack when the database + names are displayed.
+

+ + + + http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html + http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7 + + + 2007-11-11 + 2007-11-11 + + + gallery2 -- multiple vulnerabilities -- cgit