PT-2008-5576 · Phpmyadmin · Phpmyadmin

Masako Oono

·

Publicado

2008-09-30

·

Atualizado

2011-03-08

·

CVE-2008-4326

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions: phpMyAdmin versions prior to 2.11.9.2
Description: The issue allows remote attackers to bypass cross-site scripting protection mechanisms and conduct attacks via a NUL byte inside a "</script" sequence when using Internet Explorer. This is due to a problem in the PMA escapeJsString function in libraries/js escape.lib.php.
Recommendations: For versions prior to 2.11.9.2, update to version 2.11.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the PMA escapeJsString function until a patch is applied.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-4326
DSA-1675-1

Produtos afetados

Phpmyadmin