Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin before 2.6.2-rc1 allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter.

A phpMyAdmin security announcement reports :

The convcharset parameter was not correctly validated, opening the door to a XSS attack.

The remote host is affected by the vulnerability described in GLSA-200504-08 (phpMyAdmin: XSS vulnerability)

    Oriol Torrent Santiago has discovered that phpMyAdmin fails to validate     input to the 'convcharset' variable, rendering it vulnerable to     cross-site scripting attacks.
  Impact :

    By sending a specially crafted request, an attacker can inject and     execute malicious script code, potentially compromising the victim's     browser.
  Workaround :

    There is no known workaround at this time.

The installed version of phpMyAdmin suffers from a cross-site scripting vulnerability due to its failure to sanitize user input to the 'convcharset' parameter of the 'index.php' script.  A remote attacker may use these vulnerabilities to cause arbitrary code to be executed in a user's browser to steal authentication cookies and the like.

The remote host is running phpMyAdmin, an open-source software written in PHP to handle the administration of MySQL over the Web.  The remote host is vulnerable to a remote Cross-Site Scripting (XSS) flaw.  An attacker exploiting these flaws would be need to be able to convince a user to click on a malicious URL.  Upon successful exploitation, the attacker would be able to steal credentials or execute code within the browser.

ID	Name	Product	Family	Severity
19343	FreeBSD : phpmyadmin -- XSS vulnerability (58247a96-01c8-11da-bc08-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
18013	GLSA-200504-08 : phpMyAdmin: XSS vulnerability	Nessus	Gentoo Local Security Checks	medium
17689	phpMyAdmin index.php convcharset Parameter XSS	Nessus	CGI abuses : XSS	medium
2787	phpMyAdmin < 2.6.2-RC1 RCE	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2005-0992

medium

Tenable Plugins

medium

medium

medium

medium