CVE-2010-3056: XSS
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.11.x before 2.11.10.1 and 3.x before 3.3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) dbsearch.php, (2) dbsql.php, (3) dbstructure.php, (4) js/messages.php, (5) libraries/common.lib.php, (6) libraries/databaseinterface.lib.php, (7) libraries/dbi/mysql.dbi.lib.php, (8) libraries/dbi/mysqli.dbi.lib.php, (9) libraries/dbinfo.inc.php, (10) libraries/sanitizing.lib.php, (11) libraries/sqlparser.lib.php, (12) serverdatabases.php, (13) serverprivileges.php, (14) setup/config.php, (15) sql.php, (16) tblreplace.php, and (17) tblsql.php.
Other sources
Several cross-site scripting (XSS) vulnerabilities were found in phpMyAdmin versions prior to 2.11.10.1 and 3.3.5.1 [1]. A remote attacker was able to conduct an XSS attack using crafted URLs or POST parameters on several pages. This issue has been assigned the name CVE-2010-3056.
[1] http://www.phpmyadmin.net/homepage/security/PMASA-2010-5.php
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3056?
CVE-2010-3056 has been rated as a medium-severity vulnerability due to its potential to allow remote attackers to execute malicious scripts.
How do I fix CVE-2010-3056?
To fix CVE-2010-3056, upgrade to phpMyAdmin version 2.11.10.1 or 3.3.5.1 or later.
What versions of phpMyAdmin are affected by CVE-2010-3056?
CVE-2010-3056 affects phpMyAdmin versions 2.11.x before 2.11.10.1 and 3.x before 3.3.5.1.
What type of vulnerability is CVE-2010-3056?
CVE-2010-3056 is classified as a cross-site scripting (XSS) vulnerability.
Can CVE-2010-3056 be exploited?
Yes, CVE-2010-3056 can be exploited by attackers to inject arbitrary web scripts or HTML.