CVE-2006-6942: XSS
First published: Fri Jan 19 2007(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via (1) a comment for a table name, as exploited through (a) db_operations.php, (2) the db parameter to (b) db_create.php, (3) the newname parameter to db_operations.php, the (4) query_history_latest, (5) query_history_latest_db, and (6) querydisplay_tab parameters to (c) querywindow.php, and (7) the pos parameter to (d) sql.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PhpMyAdmin | =2.9.1_rc2 | |
| PhpMyAdmin | =2.9.0.1 | |
| PhpMyAdmin | =2.9.0.2 | |
| PhpMyAdmin | =2.9.0_rc1 | |
| PhpMyAdmin | =2.9.0 | |
| PhpMyAdmin | =2.9.0.3 | |
| PhpMyAdmin | <=2.9.1 | |
| PhpMyAdmin | =2.9.1_rc1 | |
| PhpMyAdmin | =2.9.0_beta1 | |
| Debian | =3.1 | |
| Debian | =4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-7
- http://www.securityfocus.com/bid/21137
- http://www.us.debian.org/security/2007/dsa-1370
- http://secunia.com/advisories/26733
- http://www.vupen.com/english/advisories/2006/4572
- http://marc.info/?l=bugtraq&m=116370414309444&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30310
Frequently Asked Questions
What is the severity of CVE-2006-6942?
CVE-2006-6942 is classified as a medium severity vulnerability that allows cross-site scripting attacks.
How do I fix CVE-2006-6942?
To fix CVE-2006-6942, upgrade to PhpMyAdmin version 2.9.1.1 or later.
Which versions of PhpMyAdmin are affected by CVE-2006-6942?
CVE-2006-6942 affects PhpMyAdmin versions up to and including 2.9.1.
What types of attacks are possible with CVE-2006-6942?
CVE-2006-6942 allows attackers to execute arbitrary HTML or web scripts in the context of the victim's browser.
Is CVE-2006-6942 a remote vulnerability?
Yes, CVE-2006-6942 is a remote vulnerability that can be exploited by attackers without physical access to the system.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/phpmyadmin
- canonical/phpmyadmin
- version/phpmyadmin/2.9.1_rc2
- version/phpmyadmin/2.9.0.1
- version/phpmyadmin/2.9.0.2
- version/phpmyadmin/2.9.0_rc1
- version/phpmyadmin/2.9.0
- version/phpmyadmin/2.9.0.3
- version/phpmyadmin/2.9.1
- version/phpmyadmin/2.9.1_rc1
- version/phpmyadmin/2.9.0_beta1
- vendor/debian
- canonical/debian
- version/debian/3.1
- version/debian/4.0