CVE-2008-4775: XSS

Published Oct 28, 2008

Updated

Cross-site scripting (XSS) vulnerability in pmdpdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and CVE-2007-5977.

Affected Software

3 affected components

phpMyAdmin phpMyAdmin=3.0.0

phpMyAdmin phpMyAdmin=2.11.9.2

phpMyAdmin phpMyAdmin=3.0.1

Event History

Oct 28, 2008

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What are the potential impacts of CVE-2008-4775?

CVE-2008-4775 can allow remote attackers to execute arbitrary web scripts or HTML in the context of a vulnerable user's session.

In which versions of phpMyAdmin is CVE-2008-4775 found?

CVE-2008-4775 affects phpMyAdmin versions 3.0.0, 2.11.9.2, and 3.0.1.

How do I mitigate CVE-2008-4775?

To mitigate CVE-2008-4775, ensure that register_globals is disabled in your php.ini configuration file.

What is the severity level of CVE-2008-4775?

CVE-2008-4775 is classified as a moderate severity vulnerability due to its ability to enable XSS attacks.

Is CVE-2008-4775 a known vulnerability?

Yes, CVE-2008-4775 is a known cross-site scripting vulnerability that has been reported and documented.