[eddie5659]

Hiya

phpMyAdmin is a graphical PHP program that allows users to perform basic MySQL database administration over the Web. phpMyAdmin versions prior to 2.6.0-pl3 are vulnerable to cross-site scripting. A remote attacker could embed malicious script in the PmaAbsoluteUri parameter in a specially-crafted URL request, or embed malicious script in the zero_rows or the sql_query parameter in a specially-crafted URL request to the read_dump.php script, which would be executed in the victim's Web browser within the security context of the hosting site, once the link is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Platforms Affected:

Tobias Ratschiller: phpMyAdmin prior to 2.6.0-pl3
Various: Any operating system Any version


http://xforce.iss.net/xforce/xfdb/18158

eddie