Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the setup script in phpMyAdmin 3.x before 3.3.7 allows remote attackers to inject arbitrary web script or HTML via a server name.

The remote host is affected by the vulnerability described in GLSA-201201-01 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in phpMyAdmin. Please       review the CVE identifiers and phpMyAdmin Security Advisories referenced       below for details.
  Impact :

    Remote attackers might be able to insert and execute PHP code, include       and execute local PHP files, or perform Cross-Site Scripting (XSS)       attacks via various vectors.
  Workaround :

    There is no known workaround at this time.

The setup script included with the version of phpMyAdmin installed on the remote host does not properly sanitize user-supplied input to the 'verbose server name' field.

A remote attacker could exploit this by tricking a user into executing arbitrary script code.

ID	Name	Product	Family	Type	Severity
57433	GLSA-201201-01 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
49142	phpMyAdmin setup.php Verbose Server Name XSS (PMASA-2010-7)	Nessus	CGI abuses : XSS	Remote	medium

Detections

Analytics

CVE-2010-3263

medium

Tenable Plugins

critical

medium