CVE-2008-4326: XSS
Published Sep 30, 2008
·Updated
The PMAescapeJsString function in libraries/jsescape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a "</script" sequence.
Affected Software
139 affected components
phpMyAdmin phpMyAdmin<=2.11.9.1
phpMyAdmin phpMyAdmin=2.0
phpMyAdmin phpMyAdmin=2.0.0
phpMyAdmin phpMyAdmin=2.0.1
phpMyAdmin phpMyAdmin=2.0.2
phpMyAdmin phpMyAdmin=2.0.3
phpMyAdmin phpMyAdmin=2.0.4
phpMyAdmin phpMyAdmin=2.0.5
phpMyAdmin phpMyAdmin=2.1
phpMyAdmin phpMyAdmin=2.1.0
phpMyAdmin phpMyAdmin=2.1.1
phpMyAdmin phpMyAdmin=2.1.2
phpMyAdmin phpMyAdmin=2.2
phpMyAdmin phpMyAdmin=2.2.0
phpMyAdmin phpMyAdmin=2.2.0_pre1
phpMyAdmin phpMyAdmin=2.2.0_pre2
phpMyAdmin phpMyAdmin=2.2.0_rc1
phpMyAdmin phpMyAdmin=2.2.0_rc2
phpMyAdmin phpMyAdmin=2.2.0_rc3
phpMyAdmin phpMyAdmin=2.2.2
phpMyAdmin phpMyAdmin=2.2.3
phpMyAdmin phpMyAdmin=2.2.4
phpMyAdmin phpMyAdmin=2.2.5
phpMyAdmin phpMyAdmin=2.2.6
phpMyAdmin phpMyAdmin=2.2.7_pl1
phpMyAdmin phpMyAdmin=2.2_pre1
phpMyAdmin phpMyAdmin=2.2_pre2
phpMyAdmin phpMyAdmin=2.2_rc1
phpMyAdmin phpMyAdmin=2.2_rc2
phpMyAdmin phpMyAdmin=2.2_rc3
phpMyAdmin phpMyAdmin=2.3.1
phpMyAdmin phpMyAdmin=2.3.2
phpMyAdmin phpMyAdmin=2.4.0
phpMyAdmin phpMyAdmin=2.5.0
phpMyAdmin phpMyAdmin=2.5.1
phpMyAdmin phpMyAdmin=2.5.2
phpMyAdmin phpMyAdmin=2.5.2_pl1
phpMyAdmin phpMyAdmin=2.5.3
phpMyAdmin phpMyAdmin=2.5.4
phpMyAdmin phpMyAdmin=2.5.5
phpMyAdmin phpMyAdmin=2.5.5_pl1
phpMyAdmin phpMyAdmin=2.5.5_rc1
phpMyAdmin phpMyAdmin=2.5.5_rc2
phpMyAdmin phpMyAdmin=2.5.6_rc1
phpMyAdmin phpMyAdmin=2.5.6_rc2
phpMyAdmin phpMyAdmin=2.5.7
phpMyAdmin phpMyAdmin=2.5.7_pl1
phpMyAdmin phpMyAdmin=2.6.0_pl1
phpMyAdmin phpMyAdmin=2.6.0_pl2
phpMyAdmin phpMyAdmin=2.6.0_pl3
phpMyAdmin phpMyAdmin=2.6.1
phpMyAdmin phpMyAdmin=2.6.1_pl1
phpMyAdmin phpMyAdmin=2.6.1_pl3
phpMyAdmin phpMyAdmin=2.6.1_rc1
phpMyAdmin phpMyAdmin=2.6.2
phpMyAdmin phpMyAdmin=2.6.2_dev
phpMyAdmin phpMyAdmin=2.6.2_pl1
phpMyAdmin phpMyAdmin=2.6.2_rc1
phpMyAdmin phpMyAdmin=2.6.3
phpMyAdmin phpMyAdmin=2.6.3_pl1
phpMyAdmin phpMyAdmin=2.6.4
phpMyAdmin phpMyAdmin=2.6.4_pl1
phpMyAdmin phpMyAdmin=2.6.4_pl2
phpMyAdmin phpMyAdmin=2.6.4_pl3
phpMyAdmin phpMyAdmin=2.6.4_pl4
phpMyAdmin phpMyAdmin=2.6.4_rc1
phpMyAdmin phpMyAdmin=2.7
phpMyAdmin phpMyAdmin=2.7.0
phpMyAdmin phpMyAdmin=2.7.0_beta1
phpMyAdmin phpMyAdmin=2.7.0_pl1
phpMyAdmin phpMyAdmin=2.7.0_pl2
phpMyAdmin phpMyAdmin=2.7.0_rc1
phpMyAdmin phpMyAdmin=2.7_pl1
phpMyAdmin phpMyAdmin=2.8.0
phpMyAdmin phpMyAdmin=2.8.0.1
phpMyAdmin phpMyAdmin=2.8.0.2
phpMyAdmin phpMyAdmin=2.8.0.3
phpMyAdmin phpMyAdmin=2.8.1
phpMyAdmin phpMyAdmin=2.8.1_dev
phpMyAdmin phpMyAdmin=2.8.2
phpMyAdmin phpMyAdmin=2.8.3
phpMyAdmin phpMyAdmin=2.8.4
phpMyAdmin phpMyAdmin=2.9
phpMyAdmin phpMyAdmin=2.9.0
phpMyAdmin phpMyAdmin=2.9.0.1
phpMyAdmin phpMyAdmin=2.9.0.2
phpMyAdmin phpMyAdmin=2.9.0.3
phpMyAdmin phpMyAdmin=2.9.0_beta1
phpMyAdmin phpMyAdmin=2.9.0_dev
phpMyAdmin phpMyAdmin=2.9.0_rc1
phpMyAdmin phpMyAdmin=2.9.1
phpMyAdmin phpMyAdmin=2.9.1.1
phpMyAdmin phpMyAdmin=2.9.1_rc1
phpMyAdmin phpMyAdmin=2.9.1_rc2
phpMyAdmin phpMyAdmin=2.9.2
phpMyAdmin phpMyAdmin=2.9_rc1
phpMyAdmin phpMyAdmin=2.10.0
phpMyAdmin phpMyAdmin=2.10.0.0
phpMyAdmin phpMyAdmin=2.10.0.1
phpMyAdmin phpMyAdmin=2.10.0.2
phpMyAdmin phpMyAdmin=2.10.1
phpMyAdmin phpMyAdmin=2.10.01
phpMyAdmin phpMyAdmin=2.10.1.0
phpMyAdmin phpMyAdmin=2.10.2
phpMyAdmin phpMyAdmin=2.10.2.0
phpMyAdmin phpMyAdmin=2.10.3
phpMyAdmin phpMyAdmin=2.10.3.0
phpMyAdmin phpMyAdmin=2.10.3rc1
phpMyAdmin phpMyAdmin=2.11.0
phpMyAdmin phpMyAdmin=2.11.0.0
phpMyAdmin phpMyAdmin=2.11.0beta1
phpMyAdmin phpMyAdmin=2.11.0rc1
phpMyAdmin phpMyAdmin=2.11.1
phpMyAdmin phpMyAdmin=2.11.1.0
phpMyAdmin phpMyAdmin=2.11.1.1
phpMyAdmin phpMyAdmin=2.11.1.2
phpMyAdmin phpMyAdmin=2.11.1rc1
phpMyAdmin phpMyAdmin=2.11.2
phpMyAdmin phpMyAdmin=2.11.2.0
phpMyAdmin phpMyAdmin=2.11.2.1
phpMyAdmin phpMyAdmin=2.11.2.2
phpMyAdmin phpMyAdmin=2.11.3
phpMyAdmin phpMyAdmin=2.11.3.0
phpMyAdmin phpMyAdmin=2.11.3rc1
phpMyAdmin phpMyAdmin=2.11.4
phpMyAdmin phpMyAdmin=2.11.4.0
phpMyAdmin phpMyAdmin=2.11.4rc1
phpMyAdmin phpMyAdmin=2.11.5
phpMyAdmin phpMyAdmin=2.11.5.0
phpMyAdmin phpMyAdmin=2.11.5.1
phpMyAdmin phpMyAdmin=2.11.5.2
phpMyAdmin phpMyAdmin=2.11.5rc1
phpMyAdmin phpMyAdmin=2.11.6
phpMyAdmin phpMyAdmin=2.11.6rc1
phpMyAdmin phpMyAdmin=2.11.7
phpMyAdmin phpMyAdmin=2.11.7.0
phpMyAdmin phpMyAdmin=2.11.8
phpMyAdmin phpMyAdmin=2.11.9
Microsoft Internet Explorer
Event History
Sep 30, 2008
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Data Sourced
04:13 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2008-4326?
CVE-2008-4326 is rated as a medium severity Cross-Site Scripting (XSS) vulnerability in phpMyAdmin versions before 2.11.9.2.
2
How do I fix CVE-2008-4326?
To fix CVE-2008-4326, upgrade to phpMyAdmin version 2.11.9.2 or later.
3
What versions are affected by CVE-2008-4326?
CVE-2008-4326 affects all phpMyAdmin versions prior to 2.11.9.2.
4
What is the impact of exploiting CVE-2008-4326?
Exploiting CVE-2008-4326 allows an attacker to bypass XSS protection mechanisms and execute malicious scripts in the context of a user's session.
5
Is CVE-2008-4326 specific to a particular web browser?
Yes, CVE-2008-4326 is notably associated with the use of Internet Explorer.