XSS vulnerability

PMASA-2007-5

Announcement-ID: PMASA-2007-5

Date: 2007-10-15

Summary

XSS vulnerability

Description

We received an advisory from Omer Singer, The DigiTrust Group, and we wish to thank him for his work.

It was possible to trigger this attack on setup.php.

Severity

We consider this vulnerability to be serious; however, we could only trigger it when using Internet Explorer with the ‘send URLs as UTF8’ setting disabled. The default value of this setting being ‘enabled’ reduces the impact of this problem.

Affected Versions

Probably all versions before 2.11.1.1.

Solution

Upgrade to phpMyAdmin 2.11.1.1 or newer.

References

<http://www.securityfocus.com/bid/26020/info&gt;

Assigned CVE ids: CVE-2007-5386

CWE ids: CWE-661 CWE-79

Patches

The following commits have been made to fix this issue:

• 27d5467dc3ba6e594d5e5cd291a908b48464e289

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.