An cross-site scripting (XSS) flaw was found in the way phpPgAdmin, a web-based PostgreSQL database administration tool, performed presentation of the default list of functions, being present in the database, to the user upon request. A remote attacker could provide a specially-crafted web page, which once visited by an unsuspecting, valid phpPgAdmin user could lead to arbitrary HTML or web script execution in the context of logged in phpPgAdmin user.

References: [1] http://archives.postgresql.org/pgsql-announce/2012-03/msg00016.php [2] https://github.com/phppgadmin/phppgadmin/commit/e92a003624609a445c4cf57c9c3d1fcef0eae47c#diff-0

Upstream patch: [3] https://github.com/phppgadmin/phppgadmin/commit/74174ad639664b52cc1609ede0af8bc403e98a00

CVE request: [4] http://www.openwall.com/lists/oss-security/2012/03/28/11

CVE assignment: [5] http://www.openwall.com/lists/oss-security/2012/03/29/6