CVE-2007-5977
published 2007-11-15CVE-2007-5977: Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to…
PriorityP413low3.5CVSS 2.0
AVNACMAuSCNIPAN
EPSS
1.25%
66.1th percentile
Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | phpmyadmin | < phpmyadmin 4:2.11.2.1-1 (bookworm) | phpmyadmin 4:2.11.2.1-1 (bookworm) |
| debian | phpmyadmin | < phpmyadmin 4:2.11.8.1-4 (bookworm) | phpmyadmin 4:2.11.8.1-4 (bookworm) |
| phpmyadmin | phpmyadmin | <= 2.11.2 | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | >= 0 < 4:2.11.8.1-4 | 4:2.11.8.1-4 |
| phpmyadmin | phpmyadmin | >= 0 < 4:2.11.2.1-1 | 4:2.11.2.1-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:2.11.8.1-4 | 4:2.11.8.1-4 |
| phpmyadmin | phpmyadmin | >= 0 < 4:2.11.2.1-1 | 4:2.11.2.1-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:2.11.8.1-4 | 4:2.11.8.1-4 |
| phpmyadmin | phpmyadmin | >= 0 < 4:2.11.2.1-1 | 4:2.11.2.1-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:2.11.8.1-4 | 4:2.11.8.1-4 |
| phpmyadmin | phpmyadmin | >= 0 < 4:2.11.2.1-1 | 4:2.11.2.1-1 |
CVSS provenance
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv6.8MEDIUM
vendor_debian6.8LOW
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
phpMyAdmin: XSS issue in pmd_pdf.php via db parameter with register_globals enabled
vendor_redhat·2008-10-27·CVSS 6.8
CVE-2008-4775 [MEDIUM] CWE-79 phpMyAdmin: XSS issue in pmd_pdf.php via db parameter with register_globals enabled
phpMyAdmin: XSS issue in pmd_pdf.php via db parameter with register_globals enabled
Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and CVE-2007-5977.
Debian
CVE-2008-4775: phpmyadmin - Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and...
vendor_debian·2008·CVSS 6.8
CVE-2008-4775 [MEDIUM] CVE-2008-4775: phpmyadmin - Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and...
Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and CVE-2007-5977.
Scope: local
bookworm: resolved (fixed in 4:2.11.8.1-4)
bullseye: resolved (fixed in 4:2.11.8.1-4)
forky: resolved (fixed in 4:2.11.8.1-4)
sid: resolved (fixed in 4:2.11.8.1-4)
trixie: resolved (fixed in 4:2.11.8.1-4)
Debian
CVE-2007-5977: phpmyadmin - Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2...
vendor_debian·2007·CVSS 6.8
CVE-2007-5977 [MEDIUM] CVE-2007-5977: phpmyadmin - Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2...
Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942.
Scope: local
bookworm: resolved (fixed in 4:2.11.2.1-1)
bullseye: resolved (fixed in 4:2.11.2.1-1)
forky: resolved (fixed in 4:2.11.2.1-1)
sid: resolved (fixed in 4:2.11.2.1-1)
trixie: resolved (fixed in 4:2.11.2.1-1)
Red Hat
XSS in db_create
vendor_redhat·CVSS 6.8
CVE-2007-5977 [MEDIUM] XSS in db_create
XSS in db_create
Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942.
GHSA
GHSA-3754-x86m-fj9m: Cross-site scripting (XSS) vulnerability in pmd_pdf
ghsa_unreviewed·2022-05-14·CVSS 6.8
CVE-2008-4775 [MEDIUM] CWE-79 GHSA-3754-x86m-fj9m: Cross-site scripting (XSS) vulnerability in pmd_pdf
Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and CVE-2007-5977.
GHSA
GHSA-7wx4-pm9p-2c7w: Cross-site scripting (XSS) vulnerability in db_create
ghsa_unreviewed·2022-05-01·CVSS 6.8
CVE-2007-5977 [MEDIUM] CWE-79 GHSA-7wx4-pm9p-2c7w: Cross-site scripting (XSS) vulnerability in db_create
Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942.
OSV
CVE-2008-4775: Cross-site scripting (XSS) vulnerability in pmd_pdf
osv·2008-10-28·CVSS 6.8
CVE-2008-4775 [MEDIUM] CVE-2008-4775: Cross-site scripting (XSS) vulnerability in pmd_pdf
Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and CVE-2007-5977.
OSV
CVE-2007-5977: Cross-site scripting (XSS) vulnerability in db_create
osv·2007-11-15·CVSS 6.8
CVE-2007-5977 [MEDIUM] CVE-2007-5977: Cross-site scripting (XSS) vulnerability in db_create
Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2008-4775 phpMyAdmin: XSS issue in pmd_pdf.php via db parameter with register_globals enabled
bugzilla·2008-10-29·CVSS 6.8
CVE-2008-4775 [MEDIUM] CVE-2008-4775 phpMyAdmin: XSS issue in pmd_pdf.php via db parameter with register_globals enabled
CVE-2008-4775 phpMyAdmin: XSS issue in pmd_pdf.php via db parameter with register_globals enabled
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-4775 to the following vulnerability:
Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin
3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when
register_globals is enabled, allows remote attackers to inject
arbitrary web script or HTML via the db parameter, a different vector
than CVE-2006-6942 and CVE-2007-5977.
References:
http://www.securityfocus.com/archive/1/archive/1/497815/100/0/threaded
http://www.securityfocus.com/bid/31928
http://secunia.com/advisories/32449
Discussion:
613 (phpMyAdmin): Build on target fedora-4-epel succeeded.
612 (phpMyAdmin): Build on target fedora-5-epel suc
Bugzilla
CVE-2007-5977 XSS in db_create
bugzilla·2007-11-15·CVSS 6.8
CVE-2007-5977 [MEDIUM] CVE-2007-5977 XSS in db_create
CVE-2007-5977 XSS in db_create
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-5977 to the following vulnerability:
Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942.
References:
http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html
http://sourceforge.net/project/shownotes.php?release_id=553333
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7
http://www.frsirt.com/english/advisories/2007/3824
http://secunia.com/advisories/27630
http://xforce.iss.net/xforce/xfdb/38404
Discussion:
d
http://secunia.com/advisories/27630http://secunia.com/advisories/27753http://sourceforge.net/project/shownotes.php?release_id=553333http://www.digitrustgroup.com/advisories/tdg-advisory071108a.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2007:229http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7http://www.securityfocus.com/bid/26512http://www.vupen.com/english/advisories/2007/3824https://exchange.xforce.ibmcloud.com/vulnerabilities/38404https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.htmlhttp://secunia.com/advisories/27630http://secunia.com/advisories/27753http://sourceforge.net/project/shownotes.php?release_id=553333http://www.digitrustgroup.com/advisories/tdg-advisory071108a.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2007:229http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7http://www.securityfocus.com/bid/26512http://www.vupen.com/english/advisories/2007/3824https://exchange.xforce.ibmcloud.com/vulnerabilities/38404https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.html
2007-11-15
Published