Versions of phpMyAdmin 3.5.x earlier than 3.5.8.2 or 4.0.x earlier than 4.0.4.2 are affected by the following multiple vulnerabilities :

 - Numerous input-validation errors exist that could lead to cross-site scripting attacks related to 'version.json', text to link transformations, schema export, SQL queries, setup, chart display, process list, and the logo link. Note that the link transformation issue, PMASA-2013-13 (CVE-2013-5001), only affects the 4.0.x branch. (CVE-2013-4995, CVE-2013-4996, CVE-2013-4997, CVE-2013-5001, CVE-2013-5002)
 - Errors exist that could allow full installation path disclosure via error messages. This information could be used in further attacks. (CVE-2013-4998, CVE-2013-4999, CVE-2013-5000)
 - Errors in the files 'schema_export.php' and 'pmd_pdf.php' could allow SQL injection attacks.(CVE-2013-5003)

Versions of phpMyAdmin 3.5.x earlier than 3.5.8.2 or 4.0.x earlier than 4.0.4.2 are affected by the following multiple vulnerabilities:

  - Numerous input-validation errors exist that could lead to cross-site scripting attacks related to 'version.json', text to link transformations, schema export, SQL queries, setup, chart display, process list, and the logo link. Note that the link transformation issue, PMASA-2013-13 (CVE-2013-5001), only affects the 4.0.x branch. (CVE-2013-4995, CVE-2013-4996, CVE-2013-4997, CVE-2013-5001, CVE-2013-5002)

  - Errors exist that could allow full installation path disclosure via error messages. This information could be used in further attacks. (CVE-2013-4998, CVE-2013-4999, CVE-2013-5000)

  - Errors in the files 'schema_export.php' and 'pmd_pdf.php' could allow SQL injection attacks.(CVE-2013-5003)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Multiple SQL injection vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow
    remote authenticated users to execute arbitrary SQL commands via (1) the scale parameter to pmd_pdf.php or
    (2) the pdf_page_number parameter to schema_export.php. (CVE-2013-5003)

  - Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2
    allows remote authenticated users to inject arbitrary web script or HTML via a crafted SQL query that is
    not properly handled during the display of row information. (CVE-2013-4995)

  - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before
    4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted
    database name, (2) a crafted user name, (3) a crafted logo URL in the navigation panel, (4) a crafted
    entry in a certain proxy list, or (5) crafted content in a version.json file. (CVE-2013-4996)

  - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote
    attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor
    identifier to setup/index.php or (2) a chartTitle (aka chart title) value. (CVE-2013-4997)

  - phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive
    information via an invalid request, which reveals the installation path in an error message, related to
    pmd_common.php and other files. (CVE-2013-4998)

According to its self-identified version number, the phpMyAdmin install hosted on the remote web server is 3.5.x earlier than 3.5.8.2 or 4.0.x earlier than 4.0.4.2.  It is, therefore, affected by the following vulnerabilities :

 - Numerous input validation errors exist that could lead    to cross-site scripting attacks related to    'version.json', text to link transformations, schema    export, SQL queries, setup, chart display, process list,    and the logo link. Note that the link transformation    issue, PMASA-2013-13 (CVE-2013-5001), only affects the    4.0.x branch. (CVE-2013-4995, CVE-2013-4996,    CVE-2013-4997, CVE-2013-5001, CVE-2013-5002)

  - Errors exist that could allow full installation path     disclosure via error messages. This information could     be used in further attacks. (CVE-2013-4998,     CVE-2013-4999, CVE-2013-5000)

  - Errors in the files 'schema_export.php' and     'pmd_pdf.php' could allow SQL injection attacks.
    (CVE-2013-5003)

The remote host is affected by the vulnerability described in GLSA-201311-02 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in phpMyAdmin. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote authenticated attacker could exploit these vulnerabilities to       execute arbitrary code with the privileges of the process running       phpMyAdmin, inject SQL code, or to conduct Cross-Site Scripting and       Clickjacking attacks.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
6967	phpMyAdmin 3.5.x < 3.5.8.2 / 4.0.x < 4.0.4.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	8/8/2013	3/6/2019	medium
8144	phpMyAdmin 3.5.x < 3.5.8.2 / 4.0.x < 4.0.4.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	3/5/2014	3/6/2019	medium
401142	Alpine: multiple phpmyadmin packages: security update to 4.0.4.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	8/16/2023	7/2/2026	high
401142	Alpine: multiple phpmyadmin packages: security update to 4.0.4.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	8/16/2023	7/2/2026	high
69184	phpMyAdmin 3.5.x < 3.5.8.2 / 4.0.x < 4.0.4.2 Multiple Vulnerabilities (PMASA-2013-8 - PMASA-2013-15	Nessus	CGI abuses	8/1/2013	11/22/2024	medium
70753	GLSA-201311-02 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	11/5/2013	1/6/2021	medium

Detections

Analytics

Plugins Search

medium

medium

high

high

medium

medium