From 943783d0d584a2f7e8fc5952e1393b0ef616029a Mon Sep 17 00:00:00 2001 From: Matthew Seaman Date: Mon, 29 Jul 2013 19:17:27 +0000 Subject: [PATCH] Now that PMSA-2013-{9,11-15} have been published, borrow from them to expand on the original rather sketchy entries. Sort URL references[1] Submitted by: remko [1] --- security/vuxml/vuln.xml | 94 +++++++++++++++++++++++++++++++++++------ 1 file changed, 82 insertions(+), 12 deletions(-) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 0a9ea286a5da..95bd42a2dde1 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -67,29 +67,98 @@ Note: Please add new entries to the beginning of this file.

The phpMyAdmin development team reports:

-

Self-XSS in "Showing rows." (phpMyAdmin35 only)

+

XSS due to unescaped HTML Output when executing a SQL query.

+

Using a crafted SQL query, it was possible to produce an + XSS on the SQL query form.

+

This vulnerability can be triggered only by someone who + logged in to phpMyAdmin, as the usual token protection + prevents non-logged-in users from accessing the required + form.

-

Self-XSS in Display chart.

-

Stored XSS in Server status monitor.

-

Stored XSS in navigation panel logo link (phpMyAdmin35 only).

-

Self-XSS in setup, trusted proxies validation.

+

5 XSS vulnerabilities in setup, chart display, process + list, and logo link.

+
-

Unencoded json object.

+

If a crafted version.json would be presented, an XSS + could be introduced.

+

Due to not properly validating the version.json file, + which is fetched from the phpMyAdmin.net website, could lead + to an XSS attack, if a crafted version.json file would be + presented.

+

This vulnerability can only be exploited with a + combination of complicated techniques and tricking the user + to visit a page.

-

Full path disclosure.

+

Full path disclosure vulnerabilities.

+

By calling some scripts that are part of phpMyAdmin in an + unexpected way, it is possible to trigger phpMyAdmin to + display a PHP error message which contains the full path of + the directory where phpMyAdmin is installed.

+

This path disclosure is possible on servers where the + recommended setting of the PHP configuration directive + display_errors is set to on, which is against the + recommendations given in the PHP manual.

-

Stored XSS in link transformation plugin.

+

XSS vulnerability when a text to link transformation is + used.

+

When the TextLinkTransformationPlugin is used to create a + link to an object when displaying the contents of a table, + the object name is not properly escaped, which could lead to + an XSS, if the object name has a crafted value.

+

The stored XSS vulnerabilities can be triggered only by + someone who logged in to phpMyAdmin, as the usual token + protection prevents non-logged-in users from accessing the + required forms.

-

Self-XSS in schema export.

+

Self-XSS due to unescaped HTML output in schema + export.

+

When calling schema_export.php with crafted parameters, + it is possible to trigger an XSS.

+

This vulnerability can be triggered only by someone who + logged in to phpMyAdmin, as the usual token protection + prevents non-logged-in users from accessing the required + form.

-

Control user SQL injection in pmd_pdf.php.

-

Control user SQL injection in schema_export.php.

+

SQL injection vulnerabilities, producing a privilege + escalation (control user).

+

Due to a missing validation of parameters passed to + schema_export.php and pmd_pdf.php, it was possible to inject + SQL statements that would run with the privileges of the + control user. This gives read and write access to the tables + of the configuration storage database, and if the control + user has the necessary privileges, read access to some + tables of the mysql database.

+

These vulnerabilities can be triggered only by someone + who logged in to phpMyAdmin, as the usual token protection + prevents non-logged-in users from accessing the required + form. Moreover, a control user must have been created and + configured as part of the phpMyAdmin configuration storage + installation.

@@ -101,12 +170,13 @@ Note: Please add new entries to the beginning of this file. http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php - http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/4.0.4.2/phpMyAdmin-4.0.4.2-notes.html/view http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/3.5.8.2/phpMyAdmin-3.5.8.2-notes.html/view + http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/4.0.4.2/phpMyAdmin-4.0.4.2-notes.html/view 2013-07-28 2013-07-28 + 2013-07-29