Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.
Description of problem: phpMyAdmin < 2.11.9.1 contains a not yet clearly documented security bug: "Welcome to this security update for phpMyAdmin 2.11.9. Details will follow on http://phpmyadmin.net. Marc Delisle, for the team"
Additional info (http://www.phpmyadmin.net/homepage/downloads.php?relnotes=0): Fixes for 2.11.9.x:
- bug #2031221 [auth] Links to version number on login screen - bug #2032707 [core] PMA does not start if iniset() is disabled - bug #2004915 [bookmarks] Saved queries greater than 1000 chars not displayed - bug #2037381 [export] Export type "replace" does not work - bug #2037375 [export] DROP PROCEDURE needs IF EXISTS - bug #2045512 [export] Numbers in Excel export + [lang] Norwegian UTF-8 original file remerged - bug #2074250 [parser] Undefined variable seenfrom - (2.11.9.1) [security] Code execution vulnerability
The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.
Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tblstructure.php with a modified table parameter. NOTE: other unspecified pages are also reachable, but they have the same root cause. NOTE: this can be leveraged to conduct SQL injection attacks and execute arbitrary code.
phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function.
Multiple cross-site scripting (XSS) vulnerabilities in the export page (displayexport.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pmadbfilenametemplate cookie.
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.11.x before 2.11.10.1 and 3.x before 3.3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) dbsearch.php, (2) dbsql.php, (3) dbstructure.php, (4) js/messages.php, (5) libraries/common.lib.php, (6) libraries/databaseinterface.lib.php, (7) libraries/dbi/mysql.dbi.lib.php, (8) libraries/dbi/mysqli.dbi.lib.php, (9) libraries/dbinfo.inc.php, (10) libraries/sanitizing.lib.php, (11) libraries/sqlparser.lib.php, (12) serverdatabases.php, (13) serverprivileges.php, (14) setup/config.php, (15) sql.php, (16) tblreplace.php, and (17) tblsql.php.
Description of problem: PhpMyAdmin 2.11.1.1 was released on October 15th, 2007 and Fedora Development hangs still around the older 2.11.0. And the release 2.11.1.1 fixes a security issue: PMASA-2007-5
Version-Release number of selected component (if applicable): phpMyAdmin-2.11.0-1
Expected results: phpMyAdmin-2.11.1.1-1 or newer ;-)
Additional info: A simple version bump did the trick for me.
Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.
Cross-site scripting (XSS) vulnerability in libraries/auth/cookie.auth.lib.php in phpMyAdmin before 2.11.2.2, when logins are authenticated with the cookie authtype, allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter to index.php, a different vulnerability than CVE-2005-0992.