Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote
    authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a
    procedure, or (3) a trigger. (CVE-2012-5339)

This update of phpMyAdmin is a version upgrade to 3.5.3.0 to fix multiple XSS flaws.

According to its self-identified version number, the phpMyAdmin 3.5.x install hosted on the remote web server is earlier than 3.5.3 and is, therefore, affected by multiple vulnerabilities :
 
  - When creating or modifying a trigger, event, or     procedure with a crafted name, it is possible for a user     to trigger a cross-site scripting (XSS) attack.

  - A man-in-the-middle (MITM) attack is possible when     fetching the version information from a non-SSL site.
    To display information about the current phpMyAdmin     version, a piece of JavaScript is fetched from the     phpmyadmin.net website in non-SSL mode. A MITM attack     could modify this script on the wire.

The phpMyAdmin development team reports :

When creating/modifying a trigger, event or procedure with a crafted name, it is possible to trigger an XSS.

To display information about the current phpMyAdmin version on the main page, a piece of JavaScript is fetched from the phpmyadmin.net website in non-SSL mode. A man-in-the-middle could modify this script on the wire to cause mischief.

ID	Name	Product	Family	Type	Severity
434970	SCA: security update for phpmyadmin/phpmyadmin (GHSA-rfpg-2fp8-2fph)	Tenable Cloud Security	SCA Checks	Local	medium
434970	SCA: security update for phpmyadmin/phpmyadmin (GHSA-rfpg-2fp8-2fph)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
74813	openSUSE Security Update : phpMyAdmin (openSUSE-SU-2012:1507-1)	Nessus	SuSE Local Security Checks	Local	medium
62663	phpMyAdmin 3.5.x < 3.5.3 Multiple Vulnerabilities (PMASA-2012-6 - PMASA-2012-7)	Nessus	CGI abuses : XSS	Remote	medium
62539	FreeBSD : phpMyAdmin -- Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack (ef417da3-1640-11e2-999b-e0cb4e266481)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2012-5339

medium

Tenable Plugins

medium

medium

medium

medium

medium