Skip to content
OpenAdvisories
Low CVE-2011-4634 EUVD-2011-4552GHSA-9j9h-cpgc-8356

phpMyAdmin vulnerable to Cross-site Scripting

Published Dec 22, 2011 · Updated Aug 7, 2024 · Assigned by mitre

Package: phpmyadmin Package: phpmyadmin/phpmyadmin Ecosystem: Debian Ecosystem: Packagist

Description

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted database name, related to the Database Synchronize panel; (2) a crafted database name, related to the Database rename panel; (3) a crafted SQL query, related to the table overview panel; (4) a crafted SQL query, related to the view creation dialog; (5) a crafted column type, related to the table search dialog; or (6) a crafted column type, related to the create index dialog.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 phpmyadmin 4:3.4.8-1 —
Debian 13 phpmyadmin 4:3.4.8-1 —
Debian 12 phpmyadmin 4:3.4.8-1 —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed phpMyAdmin 4.6.5.2-1.1 openSUSE-SU-2024:10054-1

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist phpmyadmin/phpmyadmin >= 3.4.0, < 3.4.8 3.4.8 GHSA-9j9h-cpgc-8356

Advisories 1

References