News
Vigil@nce: phpMyAdmin, two vulnerabilities
May 2011 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/
SYNTHESIS OF THE VULNERABILITY
An attacker can use two vulnerabilities of phpMyAdmin, in order to
create a Cross Site Scripting, or to redirect the victim to
another site.
– Severity: 2/4
– Creation date: 23/05/2011
IMPACTED PRODUCTS
– TYPO3
– Unix - plateform
DESCRIPTION OF THE VULNERABILITY
The phpMyAdmin program is used to administer a MySQL database. It
is impacted by two vulnerabilities.
The tbl_tracking.php page manages the tracking of table. However,
several functions in this file do not use htmlspecialchars(), in
order to filter the "db" and "table" parameters. An attacker can
therefore create a Cross Site Scripting. [severity:2/4; BID-47945,
CVE-2011-1940, PMASA-2011-3]
An attacker can use the url.php page, in order to redirect the
victim to another site with a phishing attack. [severity:2/4;
BID-47943, CVE-2011-1941, PMASA-2011-4]
An attacker can therefore use two vulnerabilities of phpMyAdmin,
in order to create a Cross Site Scripting, or to redirect the
victim to another site.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/phpMyAdmin-two-vulnerabilities-10675
