phppgadmin-xss.txt

`------=_Part_25754_4061665.1180272607070  
Content-Type: text/plain; charset=ISO-8859-1; format=flowed  
Content-Transfer-Encoding: 7bit  
Content-Disposition: inline  
  
Synopsis: Multiple XSS Vulnerabilities  
  
Introduction:  
phpPgAdmin is a web-based administration tool for PostgreSQL.  
  
Details:  
phpPgAdmin doesn't correctly sanitize data in $_SERVER array and most of the  
scripts make direct use of PHP_SELF.  
  
PoC:  
http://www.test.com/redirect.php/%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E?subject=server&server=test  
This was tested on versions 3.5 to 4.1.1 as not logged user. Other versions  
may also be vulnerable.  
  
Regards Michal Majchrowicz.  
Hack.pl  
  
------=_Part_25754_4061665.1180272607070  
Content-Type: text/html; charset=ISO-8859-1  
Content-Transfer-Encoding: 7bit  
Content-Disposition: inline  
  
Synopsis: Multiple XSS Vulnerabilities<br><br>Introduction:<br>phpPgAdmin is a web-based administration tool for PostgreSQL.<br><br>Details:<br>phpPgAdmin doesn't correctly sanitize data in $_SERVER array and most of the scripts make direct use of PHP_SELF.  
<br><br>PoC:<br><a href="http://www.test.com/redirect.php/%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E?subject=server&server=test">http://www.test.com/redirect.php/%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E?subject=server&server=test  
</a><br>This was tested on versions&nbsp; 3.5 to 4.1.1 as not logged user. Other versions may also be vulnerable.<br><br>Regards Michal Majchrowicz.<br>Hack.pl<br>  
  
------=_Part_25754_4061665.1180272607070--  
  
`