PMASA-2010-6
Announcement-ID: PMASA-2010-6
Date: 2010-08-30
Summary
XSS attack using debugging messages.
Description
It was possible to conduct a XSS attack using error messages in PHP backtrace.
Severity
We consider this vulnerability to be non critical.
Mitigation factor
Additional steps from administrator are required to actually exploit this issue (phpMyAdmin error reporting and collection needs to be enabled, what is against recommendation for production setup).
Affected Versions
For 3.x: versions before 3.3.6 are affected.
Unaffected Versions
Branch 2.11.x is not affected by this.
Solution
Upgrade to phpMyAdmin 3.3.6 or newer or apply patch listed below.
References
Thanks to Aung Khant from YGN Ethical Hacker Group, Myanmar for reporting this issue.
Assigned CVE IDs: CVE-2010-2958
Patches
The following commits have been made to fix this issue:
More information
For further information and in case of questions, please contact the phpMyAdmin security team at security@phpmyadmin.net.