Multiple cross-site scripting (XSS) vulnerabilities in the Tracking feature in phpMyAdmin 3.3.x before 3.3.10.4 and 3.4.x before 3.4.4 allow remote attackers to inject arbitrary web script or HTML via a (1) table name, (2) column name, or (3) index name.

Several vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-4107     The XML import plugin allowed a remote attacker to read     arbitrary files via XML data containing external entity     references.

  - CVE-2011-1940, CVE-2011-3181     Cross site scripting was possible in the table tracking     feature, allowing a remote attacker to inject arbitrary     web script or HTML.

The oldstable distribution (lenny) is not affected by these problems.

Changes for 3.4.4.0 (2011-08-24) :

  - [parser] SQL parser breaks AJAX requests if query has     unclosed quotes

    - [parser] Invalid escape sequence in SQL parser

    - [config] $cfg['Export']['asfile'] set to false does       not select as Text option

    - [export] Working SQL query exports error page

    - [interface] 'Create an index on X columns' form not       validated

    - [interface] JS error in Table->Structure->Index->Edit

    - [interface] Info message has 'error' class

    - [interface] TABbing through a NULL field in the inline       mode resets NULL

    - [various] remove version number in /setup

    - [usability] Missing 'Generate Password' button

    - [display] Missing Server Parameter on inline sql query

    - [navi] Drop field -> lost active table

    - [various] remove misleading comment on the 'Rename       database' interface

    - [interface] Fix footnote for inexact count while       browsing

    - [interface] Fix security warning link in setup

    - [display] Backquotes in normal text on import page

    - [core] With Suhosin, urls are too long in edit links

    - [security] Missing sanitization on the table, column       and index names leads to XSS vulnerabilities, see       PMASA-2011-13       (http://www.phpmyadmin.net/home_page/security/PMASA-20       11-13.php)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host contains a version of phpMyAdmin - 3.3.x less than 3.3.10.4 or 3.4.x less than 3.4.4 - that is affected by multiple cross-site scripting vulnerabilities.

The data in the 'table', 'column', and 'index' variables of the script 'tbl_tracking.php' are not properly sanitized before being sent to the browser.

These errors can allow an unauthenticated user to trick an authenticated user into requesting a URL thereby injecting arbitrary HTML or script code into the authenticated user's browser.

These errors can also allow an attacker who has access to the database to create persistent strings of cross-site scripting code that will inject arbitrary HTML or script code into an authenticated user's browser at a later time.

The phpMyAdmin development team reports :

Multiple XSS in the Tracking feature.

ID	Name	Product	Family	Severity
57621	Debian DSA-2391-1 : phpmyadmin - several vulnerabilities	Nessus	Debian Local Security Checks	medium
56183	Fedora 15 : phpMyAdmin-3.4.4-1.fc15 (2011-11630)	Nessus	Fedora Local Security Checks	medium
56182	Fedora 14 : phpMyAdmin-3.4.4-1.fc14 (2011-11594)	Nessus	Fedora Local Security Checks	medium
56181	Fedora 16 : phpMyAdmin-3.4.4-1.fc16 (2011-11477)	Nessus	Fedora Local Security Checks	medium
55993	phpMyAdmin 3.3.x / 3.4.x < 3.3.10.4 / 3.4.4 XSS (PMASA-2011-13	Nessus	CGI abuses : XSS	medium
55970	FreeBSD : phpMyAdmin -- multiple XSS vulnerabilities (75e26236-ce9e-11e0-b26a-00215c6a37bb)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2011-3181

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium