FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

phpMyAdmin -- Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack

Affected packages
3.5 <= phpMyAdmin < 3.5.3

Details

VuXML ID ef417da3-1640-11e2-999b-e0cb4e266481
Discovery 2012-10-08
Entry 2012-10-14

The phpMyAdmin development team reports:

When creating/modifying a trigger, event or procedure with a crafted name, it is possible to trigger an XSS.

To display information about the current phpMyAdmin version on the main page, a piece of JavaScript is fetched from the phpmyadmin.net website in non-SSL mode. A man-in-the-middle could modify this script on the wire to cause mischief.

References

CVE Name CVE-2012-5339
CVE Name CVE-2012-5368
URL http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php
URL http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php