phpmyadmin phpmyadmin 3.3.9.0 vulnerabilities and exploits

(subscribe to this query)

error.php in PhpMyAdmin 3.3.8.1, and other versions prior to 3.4.0-beta1, allows remote malicious users to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing "@" characters, as demonstrated using "[a@url@page]".

Phpmyadmin Phpmyadmin 3.3.9.0 Phpmyadmin Phpmyadmin 3.3.8.1

1 EDB exploit

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x prior to 3.3.10.1 and 3.4.x prior to 3.4.1 allow remote malicious users to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to (1)...

Phpmyadmin Phpmyadmin 3.3.10.0 Phpmyadmin Phpmyadmin 3.4.0.0 Phpmyadmin Phpmyadmin 3.3.8.1 Phpmyadmin Phpmyadmin 3.3.3.0 Phpmyadmin Phpmyadmin 3.3.4.0 Phpmyadmin Phpmyadmin 3.3.9.2 Phpmyadmin Phpmyadmin 3.3.1.0 Phpmyadmin Phpmyadmin 3.3.7 Phpmyadmin Phpmyadmin 3.3.5.0 Phpmyadmin Phpmyadmin 3.3.0.0 Phpmyadmin Phpmyadmin 3.3.6 Phpmyadmin Phpmyadmin 3.3.2.0 Phpmyadmin Phpmyadmin 3.3.9.0 Phpmyadmin Phpmyadmin 3.3.5.1 Phpmyadmin Phpmyadmin 3.3.9.1 Phpmyadmin Phpmyadmin 3.3.8

Multiple cross-site scripting (XSS) vulnerabilities in the Tracking feature in phpMyAdmin 3.3.x prior to 3.3.10.4 and 3.4.x prior to 3.4.4 allow remote malicious users to inject arbitrary web script or HTML via a (1) table name, (2) column name, or (3) index name.

Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x prior to 3.3.10.2 and 3.4.x prior to 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot d...

libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x prior to 3.3.10.2 and 3.4.x prior to 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote malicious users to modify the SESSION superglob...

2 EDB exploits

setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x prior to 3.3.10.2 and 3.4.x prior to 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote malicious users to conduct static code injection attacks by leveraging the ability to modi...

2 EDB exploits

libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x prior to 3.3.10.2 and 3.4.x prior to 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and cons...

libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x prior to 3.3.10.3 and 3.4.x prior to 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote malicious users to modify the SESSION superglobal array, other superglobal arrays,...

The PMA_Bookmark_get function in libraries/bookmark.lib.php in phpMyAdmin 2.11.x prior to 2.11.11.3, and 3.3.x prior to 3.3.9.2, does not properly restrict bookmark queries, which makes it easier for remote authenticated users to trigger another user's execution of a SQL que...

phpMyAdmin 2.11.x prior to 2.11.11.2, and 3.3.x prior to 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote malicious users to obtain the installation path via a direct request for a nonexistent file.

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook