phpmyadmin -- insufficient input sanitising

ID DSA-2097
Type debian
Reporter Debian
Modified 2010-08-29T00:00:00


Several remote vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems:

The configuration setup script does not properly sanitise its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request. In Debian, the setup tool is protected through Apache HTTP basic authentication by default.

Various cross site scripting issues have been discovered that allow a remote attacker to inject arbitrary web script or HTML.

For the stable distribution (lenny), these problems have been fixed in version

For the testing (squeeze) and unstable distribution (sid), these problems have been fixed in version

We recommend that you upgrade your phpmyadmin package.