From b54ea7efac86acf1b3b96a56150335a0ec690e94 Mon Sep 17 00:00:00 2001 From: stas Date: Wed, 17 Oct 2007 22:15:35 +0000 Subject: - Add entry about recent phpMyAdmin XSS server_status.php vulnerability - Fix URL in my previous entry while I'm here. --- security/vuxml/vuln.xml | 33 +++++++++++++++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-) (limited to 'security') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 99633a83f3c1..065828824f03 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,35 @@ Note: Please add new entries to the beginning of this file. --> + + phpmyadmin -- cross-site scripting vulnerability + + + phpMyAdmin + 2.11.1.2 + + + + +

The DigiTrust Group discovered serious XSS vulnerability in + the phpMyAdmin server_status.php script. According to their + report

+
vulnerability can be exploited to execute arbitrary HTML and + script code in a user's browser session in context of an affected + site.
+

+ + + + http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html + http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6 + + + 2007-10-17 + 2006-10-17 + + phpmyadmin -- cross-site scripting vulnerability @@ -45,7 +74,7 @@ Note: Please add new entries to the beginning of this file.

SecurityFocus reports:

+

phpMyAdmin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script @@ -65,7 +94,7 @@ Note: Please add new entries to the beginning of this file. 2007-10-12 2006-10-16 - 2007-10-16 + 2007-10-17 -- cgit