Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_HOST variable and (2) various scripts in the libraries directory that handle header generation.

The phpmyadmin update in DSA 1207 introduced a regression. This update corrects this flaw. For completeness, please find below the original advisory text :

  Several remote vulnerabilities have been discovered in phpMyAdmin, a   program to administrate MySQL over the web. The Common   Vulnerabilities and Exposures project identifies the following   problems :

    - CVE-2005-3621       CRLF injection vulnerability allows remote attackers       to conduct HTTP response splitting attacks.

    - CVE-2005-3665       Multiple cross-site scripting (XSS) vulnerabilities       allow remote attackers to inject arbitrary web script       or HTML via the (1) HTTP_HOST variable and (2) various       scripts in the libraries directory that handle header       generation.

    - CVE-2006-1678       Multiple cross-site scripting (XSS) vulnerabilities       allow remote attackers to inject arbitrary web script       or HTML via scripts in the themes directory.

    - CVE-2006-2418       A cross-site scripting (XSS) vulnerability allows       remote attackers to inject arbitrary web script or       HTML via the db parameter of footer.inc.php.

    - CVE-2006-5116       A remote attacker could overwrite internal variables       through the _FILES global variable.

A phpMyAdmin security advisory reports :

It was possible to conduct an XSS attack via the HTTP_HOST variable;
also, some scripts in the libraries directory that handle header generation were vulnerable to XSS.

The remote host is affected by the vulnerability described in GLSA-200512-03 (phpMyAdmin: Multiple vulnerabilities)

    Stefan Esser from Hardened-PHP reported about multiple     vulnerabilities found in phpMyAdmin. The $GLOBALS variable allows     modifying the global variable import_blacklist to open phpMyAdmin to     local and remote file inclusion, depending on your PHP version     (CVE-2005-4079, PMASA-2005-9). Furthermore, it is also possible to     conduct an XSS attack via the $HTTP_HOST variable and a local and     remote file inclusion because the contents of the variable are under     total control of the attacker (CVE-2005-3665, PMASA-2005-8).
  Impact :

    A remote attacker may exploit these vulnerabilities by sending     malicious requests, causing the execution of arbitrary code with the     rights of the user running the web server. The cross-site scripting     issues allow a remote attacker to inject and execute malicious script     code or to steal cookie-based authentication credentials, potentially     allowing unauthorized access to phpMyAdmin.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
23656	Debian DSA-1207-2 : phpmyadmin - several vulnerabilities	Nessus	Debian Local Security Checks	medium
21432	FreeBSD : phpmyadmin -- XSS vulnerabilities (59ada6e5-676a-11da-99f6-00123ffe8333)	Nessus	FreeBSD Local Security Checks	medium
20312	GLSA-200512-03 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2005-3665

medium

Tenable Plugins

medium

medium

medium