PT-2007-1222 · Phpmyadmin · Phpmyadmin

Laurent Gaffié · Published 2007-01-19 · Updated 2017-07-29 · CVE-2006-6942

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PhpMyAdmin versions prior to 2.9.1.1

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary HTML or web script via several parameters and files, including:

• a comment for a table name,
• the db parameter to "db create.php",
• the newname parameter to "db operations.php",
• the query history latest, query history latest db, and querydisplay tab parameters to "querywindow.php",
• the pos parameter to "sql.php". No information is provided about the estimated number of potentially affected devices or real-world incidents.

Recommendations: For versions prior to 2.9.1.1, update to version 2.9.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints, such as "db operations.php", "db create.php", "querywindow.php", and "sql.php", until a patch is applied. Avoid using the vulnerable parameters, such as db, newname, query history latest, query history latest db, querydisplay tab, and pos, in the affected files until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2006-6942

DSA-1370-1

DSA-1370-2

Affected Products

Phpmyadmin

References · 16

• 🔥 https://exploit-db.com/exploits/29059 · Exploit
• 🔥 https://exploit-db.com/exploits/29061 · Exploit
• 🔥 https://exploit-db.com/exploits/29060 · Exploit
• 🔥 https://exploit-db.com/exploits/29058 · Exploit
• http://us.debian.org/security/2007/dsa-1370 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-6942 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-6942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6942 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-6942 · Vendor Advisory
• http://phpmyadmin.net/home_page/security.php?issue=PMASA-2006-7 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30310 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6942 · Note
• http://vupen.com/english/advisories/2006/4572 · Note
• http://secunia.com/advisories/26733 · Note
• http://marc.info/?l=bugtraq&m=116370414309444&w=2 · Note