CVE-2006-6942: XSS
Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via (1) a comment for a table name, as exploited through (a) dboperations.php, (2) the db parameter to (b) dbcreate.php, (3) the newname parameter to dboperations.php, the (4) queryhistorylatest, (5) queryhistorylatestdb, and (6) querydisplaytab parameters to (c) querywindow.php, and (7) the pos parameter to (d) sql.php.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2006-6942?
CVE-2006-6942 is classified as a medium severity vulnerability that allows cross-site scripting attacks.
How do I fix CVE-2006-6942?
To fix CVE-2006-6942, upgrade to PhpMyAdmin version 2.9.1.1 or later.
Which versions of PhpMyAdmin are affected by CVE-2006-6942?
CVE-2006-6942 affects PhpMyAdmin versions up to and including 2.9.1.
What types of attacks are possible with CVE-2006-6942?
CVE-2006-6942 allows attackers to execute arbitrary HTML or web scripts in the context of the victim's browser.
Is CVE-2006-6942 a remote vulnerability?
Yes, CVE-2006-6942 is a remote vulnerability that can be exploited by attackers without physical access to the system.