CVE-2008-4326
published 2008-09-30CVE-2008-4326: The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass…
PriorityP416medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.86%
76.9th percentile
The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a "</script" sequence.
Affected
143 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | phpmyadmin | < phpmyadmin 4:2.11.8.1-3 (bookworm) | phpmyadmin 4:2.11.8.1-3 (bookworm) |
| phpmyadmin | phpmyadmin | <= 2.11.9.1 | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2008-4326: phpmyadmin - The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin bef...
vendor_debian·2008·CVSS 4.3
CVE-2008-4326 [MEDIUM] CVE-2008-4326: phpmyadmin - The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin bef...
The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a "</script" sequence.
Scope: local
bookworm: resolved (fixed in 4:2.11.8.1-3)
bullseye: resolved (fixed in 4:2.11.8.1-3)
forky: resolved (fixed in 4:2.11.8.1-3)
sid: resolved (fixed in 4:2.11.8.1-3)
trixie: resolved (fixed in 4:2.11.8.1-3)
Red Hat
phpMyAdmin: XSS in MSIE using NUL byte
vendor_redhat·CVSS 4.3
CVE-2008-4326 [MEDIUM] phpMyAdmin: XSS in MSIE using NUL byte
phpMyAdmin: XSS in MSIE using NUL byte
The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a "</script" sequence.
GHSA
GHSA-x3hp-v67w-2vc2: The PMA_escapeJsString function in libraries/js_escape
ghsa_unreviewed·2022-05-02
CVE-2008-4326 [MEDIUM] CWE-79 GHSA-x3hp-v67w-2vc2: The PMA_escapeJsString function in libraries/js_escape
The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a "</script" sequence.
OSV
CVE-2008-4326: The PMA_escapeJsString function in libraries/js_escape
osv·2008-09-30·CVSS 4.3
CVE-2008-4326 [MEDIUM] CVE-2008-4326: The PMA_escapeJsString function in libraries/js_escape
The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a "</script" sequence.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://jvn.jp/en/jp/JVN54824688/index.htmlhttp://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000061.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.htmlhttp://osvdb.org/48511http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/libraries/js_escape.lib.php?r1=11514&r2=11603&pathrev=11603http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/js_escape.lib.php?view=log&pathrev=11603http://secunia.com/advisories/31974http://secunia.com/advisories/31992http://secunia.com/advisories/32954http://secunia.com/advisories/33822http://typo3.org/teams/security/security-bulletins/typo3-20080924-1/http://www.debian.org/security/2008/dsa-1675http://www.openwall.com/lists/oss-security/2008/09/22/2http://www.phpmyadmin.net/home_page/downloads.php?relnotes=1http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8http://www.vupen.com/english/advisories/2008/2657http://jvn.jp/en/jp/JVN54824688/index.htmlhttp://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000061.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.htmlhttp://osvdb.org/48511http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/libraries/js_escape.lib.php?r1=11514&r2=11603&pathrev=11603http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/js_escape.lib.php?view=log&pathrev=11603http://secunia.com/advisories/31974http://secunia.com/advisories/31992http://secunia.com/advisories/32954http://secunia.com/advisories/33822http://typo3.org/teams/security/security-bulletins/typo3-20080924-1/http://www.debian.org/security/2008/dsa-1675http://www.openwall.com/lists/oss-security/2008/09/22/2http://www.phpmyadmin.net/home_page/downloads.php?relnotes=1http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8http://www.vupen.com/english/advisories/2008/2657
2008-09-30
Published