REDHAT-BUG-743205: XSS
Multiple cross-site scripting (XSS) flaws were reported in phpPgAdmin: 1) the 'title' argument of a particular web page was not sanitized properly prior displaying the page header, 2) the return ULR ('returnurl') and return link name ('returndesc') were not sanitized properly prior displaying the requested page data.
A remote attacker could provide a specially-crafted URL, which once visited by an unsuspecting phpPgAdmin user could lead to arbitrary HTML or web script execution.
References: [1] https://secunia.com/advisories/46248/ [2] https://bugs.gentoo.org/showbug.cgi?id=385505 [3] http://phppgadmin.sourceforge.net/doku.php?id=download [4] http://sourceforge.net/mailarchive/forum.php?threadname=4E897F6C.90905%40free.fr&forumname=phppgadmin-news
Upstream patch: [5] https://github.com/phppgadmin/phppgadmin/commit/1df248203de055f97e092b50b1dd9643ccb73842
Affected Software
Event History
Frequently Asked Questions
What are the XSS vulnerabilities in REDHAT-BUG-743205?
REDHAT-BUG-743205 describes multiple cross-site scripting (XSS) flaws in phpPgAdmin related to improper sanitization of the 'title' argument, 'return_url', and 'return_desc' variables.
How can I mitigate the risks of REDHAT-BUG-743205?
To mitigate the risks of REDHAT-BUG-743205, implement appropriate input validation and sanitization for all user-supplied data in phpPgAdmin.
What versions of phpPgAdmin are affected by REDHAT-BUG-743205?
REDHAT-BUG-743205 affects multiple versions of phpPgAdmin that fail to properly sanitize input.
Is there an updated version to fix REDHAT-BUG-743205?
Users should check for the latest updates of phpPgAdmin that address the XSS vulnerabilities described in REDHAT-BUG-743205.
What actions should I take if I am using phpPgAdmin with REDHAT-BUG-743205?
If you are using phpPgAdmin with REDHAT-BUG-743205, it's crucial to review and sanitize input handling to prevent possible exploitation.