Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2007-5589 — Cross-site Scripting in Phpmyadmin

CWE-79 — Cross-site Scripting6 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
11.4%
top 6.40%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
PhpmyadminDebian Phpmyadmin
Timeline
PublishedOct 19
Latest updateMay 1

Description

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in (1) PHP_SELF in (a) server_status.php, and (b) grab_globals.lib.php, (c) display_change_password.lib.php, and (d) common.lib.php in libraries/; and certain input available in PHP_SELF and (2) PATH_INFO in libraries/common.inc.php. NOTE: there might also be other vectors related to (3) REQUEST_URI.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/phpmyadmin< phpmyadmin 4:2.11.1.2-1 (bookworm)
▶Debianphpmyadmin/phpmyadmin< 4:2.11.1.2-1+3
▶NVDphpmyadmin/phpmyadmin2.11.1.1

🔴Vulnerability Details

2
GHSA
GHSA-9cxr-7vrj-vpj8: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2↗2022-05-01
▶
OSV
CVE-2007-5589: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2↗2007-10-19
▶

💥Exploits & PoCs

1
Exploit-DB
phpMyAdmin 2.11.1 - 'Server_Status.php' Cross-Site Scripting↗2007-10-17
▶

📋Vendor Advisories

1
Debian
CVE-2007-5589: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1....↗2007
▶

💬Community

1
Bugzilla
phpMyAdmin 2.11.1.2 is released (fixes CVE-2007-5386, CVE-2007-5589)↗2007-10-16
▶