CVE-2012-1600: XSS
An cross-site scripting (XSS) flaw was found in the way phpPgAdmin, a web-based PostgreSQL database administration tool, performed presentation of the default list of functions, being present in the database, to the user upon request. A remote attacker could provide a specially-crafted web page, which once visited by an unsuspecting, valid phpPgAdmin user could lead to arbitrary HTML or web script execution in the context of logged in phpPgAdmin user.
References: [1] http://archives.postgresql.org/pgsql-announce/2012-03/msg00016.php [2] https://github.com/phppgadmin/phppgadmin/commit/e92a003624609a445c4cf57c9c3d1fcef0eae47c#diff-0
Upstream patch: [3] https://github.com/phppgadmin/phppgadmin/commit/74174ad639664b52cc1609ede0af8bc403e98a00
CVE request: [4] http://www.openwall.com/lists/oss-security/2012/03/28/11
CVE assignment: [5] http://www.openwall.com/lists/oss-security/2012/03/29/6
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in functions.php in phpPgAdmin before 5.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) type of a function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1600?
CVE-2012-1600 has been assigned a medium severity level due to its potential for exploitation via cross-site scripting.
How do I fix CVE-2012-1600?
To fix CVE-2012-1600, upgrade to phpPgAdmin version 5.0.4 or later, which addresses the XSS vulnerability.
What versions of phpPgAdmin are affected by CVE-2012-1600?
CVE-2012-1600 affects phpPgAdmin versions up to and including 5.0.3.
Can CVE-2012-1600 be exploited remotely?
Yes, CVE-2012-1600 can be exploited remotely by attackers through specially crafted web pages.
What type of vulnerability is CVE-2012-1600?
CVE-2012-1600 is classified as a cross-site scripting (XSS) vulnerability.