pMyAdmin 3.3.5.1 – ‘db_create.php’ Cross-Site Scripting

Exploit Database
125 阅读

作者： Liscker

日期： 2010-03-12
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/33754/

source: https://www.securityfocus.com/bid/38707/info

phpMyAdmin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

phpMyAdmin 3.3.0 is vulnerable; other versions may also be affected.

http://www.example.com/phpmyadmin/db_create.php?token=567eb60e7b1692f64df9251ab7ae3934&reload=1&new_db=%3Cscript%3Ealert%28%2Fliscker%2F%29%3B%3C%2Fscript%3E&db_collation=

last Exploits
pMyAdmin 3.3.5.1 – ‘db_create.php’ Cross-Site Scripting的更多信息

Zeeways Adserver – Multiple Vulnerabilities：
Sitefinity CMS – ‘ASP.NET’ Arbitrary File Upload：
Joomla! Component com_spielothek 1.6.9 – Multiple Blind SQL Injections：
WordPress Plugin Accept Signups 0.1 – ’email’ Cross-Site Scripting：
Google AdWords 6.2.0 API client libraries – XML eXternal Entity Injection：
CMSimple 5.2 – ‘External’ Stored XSS：
Allomani E-Store 1.0 – Cross-Site Request Forgery (Add Admin) (1)：
DIGISOL DG-HR1400 Wireless Router – Cross-Site Request Forgery：