FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

phpMyAdmin -- Multiple XSS in Table operations, Database structure, Trigger and Visualize GIS data pages

Affected packages
phpMyAdmin <


VuXML ID db1d3340-e83b-11e1-999b-e0cb4e266481
Discovery 2012-08-12
Entry 2012-08-17

The phpMyAdmin development team reports:

Using a crafted table name, it was possible to produce a XSS : 1) On the Database Structure page, creating a new table with a crafted name 2) On the Database Structure page, using the Empty and Drop links of the crafted table name 3) On the Table Operations page of a crafted table, using the 'Empty the table (TRUNCATE)' and 'Delete the table (DROP)' links 4) On the Triggers page of a database containing tables with a crafted name, when opening the 'Add Trigger' popup 5) When creating a trigger for a table with a crafted name, with an invalid definition. Having crafted data in a database table, it was possible to produce a XSS : 6) When visualizing GIS data, having a crafted label name.


CVE Name CVE-2012-4345