phpMyAdmin 4.0.x < 4.0.3 'view_create.php' XSS

Low Nessus Network Monitor Plugin ID 6919

Synopsis

The remote web server contains a PHP application that is affected by a potential security vulnerability.

Description

Versions of phpMyAdmin 4.0.0 through 4.0.3 are potentially affected by a cross site scripting vulnerability in the 'view_create.php' script of the 'Create View' page. The issue occurs when creating a view with a crafted name and an incorrect 'CREATE' statement. An attacker may leverage this to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Solution

Apply the vendor patches or upgrade to phpMyAdmin 4.0.3 or later.

See Also

http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php

http://github.com/phpmyadmin/phpmyadmin/commit/9b3551601ce714adb5e3f428476052f0ec6093bf

Plugin Details

Severity: Low

ID: 6919

File Name: 6919.prm

Family: CGI

Published: 2013/07/10

Modified: 2016/03/02

Dependencies: 9102

Risk Information

Risk Factor: Low

CVSSv2

Base Score: 3.5

Temporal Score: 2.9

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 3

Temporal Score: 2.8

Vector: CVSS3#AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:phpmyadmin:phpmyadmin

Patch Publication Date: 2013/06/05

Vulnerability Publication Date: 2013/06/05

Reference Information

CVE: CVE-2013-3742

BID: 61029