phpmyadmin phpmyadmin 4.0.10.5 vulnerabilities and exploits

(subscribe to this query)

An issue exists in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (before 4.0.10.16) are affected.

The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x prior to 4.0.10.13, 4.4.x prior to 4.4.15.3, and 4.5.x prior to 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote malicious users to guess passwords via a brute-force approach.

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x prior to 4.0.10.5, 4.1.x prior to 4.1.14.6, and 4.2.x prior to 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to th...

libraries/config/messages.inc.php in phpMyAdmin 4.0.x prior to 4.0.10.12, 4.4.x prior to 4.4.15.2, and 4.5.x prior to 4.5.3.1 allows remote malicious users to obtain sensitive information via a crafted request, which reveals the full path in an error message.

Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x prior to 4.0.10.10, 4.2.x prior to 4.2.13.3, 4.3.x prior to 4.3.13.1, and 4.4.x prior to 4.4.6.1 allow remote malicious users to hijack the authentication of administrators for req...

libraries/Config.class.php in phpMyAdmin 4.0.x prior to 4.0.10.10, 4.2.x prior to 4.2.13.3, 4.3.x prior to 4.3.13.1, and 4.4.x prior to 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle malicious users to spoof servers a...

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x prior to 4.0.10.6, 4.1.x prior to 4.1.14.7, and 4.2.x prior to 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is ...

libraries/select_lang.lib.php in phpMyAdmin 4.0.x prior to 4.0.10.9, 4.2.x prior to 4.2.13.2, and 4.3.x prior to 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier fo...

libraries/common.inc.php in phpMyAdmin 4.0.x prior to 4.0.10.7, 4.1.x prior to 4.1.14.8, and 4.2.x prior to 4.2.13.1 allows remote malicious users to cause a denial of service (resource consumption) via a long password.

1 EDB exploit

phpMyAdmin 4.0.x prior to 4.0.10.13, 4.4.x prior to 4.4.15.3, and 4.5.x prior to 4.5.4 allows remote malicious users to obtain sensitive information via a crafted request, which reveals the full path in an error message.

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook