Download 5.2.1 Try demo Donate

PMASA-2010-6

Announcement-ID: PMASA-2010-6

Date: 2010-08-30

Summary

XSS attack using debugging messages.

Description

It was possible to conduct a XSS attack using error messages in PHP backtrace.

Severity

We consider this vulnerability to be non critical.

Mitigation factor

Additional steps from administrator are required to actually exploit this issue (phpMyAdmin error reporting and collection needs to be enabled, what is against recommendation for production setup).

Affected Versions

For 3.x: versions before 3.3.6 are affected.

Unaffected Versions

Branch 2.11.x is not affected by this.

Solution

Upgrade to phpMyAdmin 3.3.6 or newer or apply patch listed below.

References

Thanks to Aung Khant from YGN Ethical Hacker Group, Myanmar for reporting this issue.

Assigned CVE ids: CVE-2010-2958

CWE ids: CWE-661 CWE-79

Patches

The following commits have been made to fix this issue:

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.

Announcements