PT-2012-1538

CVE-2011-1940

Published

2012-01-26

Updated

2022-05-17

Description by

CVSS 2.0

4.3

Medium

MetricsAV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 3.3.x through 3.3.10.0 phpMyAdmin versions 3.4.x through 3.4.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via a crafted table name, triggering improper HTML rendering on a Tracking page. This is related to the libraries/tbl links.inc.php and tbl tracking.php files.

Recommendations For phpMyAdmin versions 3.3.x through 3.3.10.0, update to version 3.3.10.1 or later. For phpMyAdmin versions 3.4.x through 3.4.0, update to version 3.4.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Dave B

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2011-1940