REDHAT-BUG-743205: XSS
First published: Tue Oct 04 2011(Updated: )
Multiple cross-site scripting (XSS) flaws were reported in phpPgAdmin: 1) the 'title' argument of a particular web page was not sanitized properly prior displaying the page header, 2) the return ULR ('return_url') and return link name ('return_desc') were not sanitized properly prior displaying the requested page data. A remote attacker could provide a specially-crafted URL, which once visited by an unsuspecting phpPgAdmin user could lead to arbitrary HTML or web script execution. References: [1] <a href="https://secunia.com/advisories/46248/">https://secunia.com/advisories/46248/</a> [2] <a href="https://bugs.gentoo.org/show_bug.cgi?id=385505">https://bugs.gentoo.org/show_bug.cgi?id=385505</a> [3] <a href="http://phppgadmin.sourceforge.net/doku.php?id=download">http://phppgadmin.sourceforge.net/doku.php?id=download</a> [4] <a href="http://sourceforge.net/mailarchive/forum.php?thread_name=4E897F6C.90905%40free.fr&forum_name=phppgadmin-news">http://sourceforge.net/mailarchive/forum.php?thread_name=4E897F6C.90905%40free.fr&forum_name=phppgadmin-news</a> Upstream patch: [5] <a href="https://github.com/phppgadmin/phppgadmin/commit/1df248203de055f97e092b50b1dd9643ccb73842">https://github.com/phppgadmin/phppgadmin/commit/1df248203de055f97e092b50b1dd9643ccb73842</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| phpPgAdmin |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://secunia.com/advisories/46248/
- https://bugs.gentoo.org/show_bug.cgi?id=385505
- http://phppgadmin.sourceforge.net/doku.php?id=download
- http://sourceforge.net/mailarchive/forum.php?thread_name=4E897F6C.90905%40free.fr&forum_name=phppgadmin-news
- https://github.com/phppgadmin/phppgadmin/commit/1df248203de055f97e092b50b1dd9643ccb73842
- http://www.openwall.com/lists/oss-security/2011/10/04/1
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=743207
- http://www.openwall.com/lists/oss-security/2011/10/04/10
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=743205#c5
- https://bugzilla.redhat.com/show_bug.cgi?id=743205
Frequently Asked Questions
What are the XSS vulnerabilities in REDHAT-BUG-743205?
REDHAT-BUG-743205 describes multiple cross-site scripting (XSS) flaws in phpPgAdmin related to improper sanitization of the 'title' argument, 'return_url', and 'return_desc' variables.
How can I mitigate the risks of REDHAT-BUG-743205?
To mitigate the risks of REDHAT-BUG-743205, implement appropriate input validation and sanitization for all user-supplied data in phpPgAdmin.
What versions of phpPgAdmin are affected by REDHAT-BUG-743205?
REDHAT-BUG-743205 affects multiple versions of phpPgAdmin that fail to properly sanitize input.
Is there an updated version to fix REDHAT-BUG-743205?
Users should check for the latest updates of phpPgAdmin that address the XSS vulnerabilities described in REDHAT-BUG-743205.
What actions should I take if I am using phpPgAdmin with REDHAT-BUG-743205?
If you are using phpPgAdmin with REDHAT-BUG-743205, it's crucial to review and sanitize input handling to prevent possible exploitation.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-3598
- agent/weakness
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/phppgadmin
- canonical/phppgadmin