phpMyAdmin 4.0.x < 4.0.3 'view_create.php' XSS

Low Nessus Network Monitor Plugin ID 6919


The remote web server contains a PHP application that is affected by a potential security vulnerability.


Versions of phpMyAdmin 4.0.0 through 4.0.3 are potentially affected by a cross site scripting vulnerability in the 'view_create.php' script of the 'Create View' page. The issue occurs when creating a view with a crafted name and an incorrect 'CREATE' statement. An attacker may leverage this to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks.


Apply the vendor patches or upgrade to phpMyAdmin 4.0.3 or later.

See Also

Plugin Details

Severity: Low

ID: 6919

File Name: 6919.prm

Family: CGI

Published: 2013/07/10

Modified: 2016/03/02

Dependencies: 9102

Risk Information

Risk Factor: Low


Base Score: 3.5

Temporal Score: 2.9

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N

Temporal Vector: CVSS2#E:F/RL:OF/RC:C


Base Score: 3

Temporal Score: 2.8


Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:phpmyadmin:phpmyadmin

Patch Publication Date: 2013/06/05

Vulnerability Publication Date: 2013/06/05

Reference Information

CVE: CVE-2013-3742

BID: 61029