FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

phpMyAdmin -- Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack

Affected packages
3.5 <= phpMyAdmin < 3.5.3


VuXML ID ef417da3-1640-11e2-999b-e0cb4e266481
Discovery 2012-10-08
Entry 2012-10-14

The phpMyAdmin development team reports:

When creating/modifying a trigger, event or procedure with a crafted name, it is possible to trigger an XSS.

To display information about the current phpMyAdmin version on the main page, a piece of JavaScript is fetched from the website in non-SSL mode. A man-in-the-middle could modify this script on the wire to cause mischief.


CVE Name CVE-2012-5339
CVE Name CVE-2012-5368