CVE-2009-1150
published 2009-03-26CVE-2009-1150: Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1…
PriorityP419medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.60%
73.3th percentile
Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pma_db_filename_template cookie.
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | phpmyadmin | < phpmyadmin 4:3.1.3.1-1 (bookworm) | phpmyadmin 4:3.1.3.1-1 (bookworm) |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2009-1150: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_...
vendor_debian·2009·CVSS 4.3
CVE-2009-1150 [MEDIUM] CVE-2009-1150: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_...
Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pma_db_filename_template cookie.
Scope: local
bookworm: resolved (fixed in 4:3.1.3.1-1)
bullseye: resolved (fixed in 4:3.1.3.1-1)
forky: resolved (fixed in 4:3.1.3.1-1)
sid: resolved (fixed in 4:3.1.3.1-1)
trixie: resolved (fixed in 4:3.1.3.1-1)
Red Hat
phpMyAdmin: multiple security fixes in 3.1.3.1 (PMASA-2009-{1,2,3})
vendor_redhat·CVSS 4.3
CVE-2009-1150 [MEDIUM] phpMyAdmin: multiple security fixes in 3.1.3.1 (PMASA-2009-{1,2,3})
phpMyAdmin: multiple security fixes in 3.1.3.1 (PMASA-2009-{1,2,3})
Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pma_db_filename_template cookie.
GHSA
GHSA-pgqx-hcp9-24pq: Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export
ghsa_unreviewed·2022-05-02
CVE-2009-1150 [MEDIUM] CWE-79 GHSA-pgqx-hcp9-24pq: Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export
Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pma_db_filename_template cookie.
OSV
CVE-2009-1150: Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export
osv·2009-03-26·CVSS 4.3
CVE-2009-1150 [MEDIUM] CVE-2009-1150: Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export
Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pma_db_filename_template cookie.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.htmlhttp://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/phpMyAdmin/libraries/display_export.lib.php?r1=11986&r2=12302&pathrev=12302http://secunia.com/advisories/34430http://secunia.com/advisories/34642http://secunia.com/advisories/35585http://secunia.com/advisories/35635http://security.gentoo.org/glsa/glsa-200906-03.xmlhttp://www.debian.org/security/2009/dsa-1824http://www.mandriva.com/security/advisories?name=MDVSA-2009:115http://www.phpmyadmin.net/home_page/security/PMASA-2009-2.phphttp://www.securityfocus.com/bid/34251http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.htmlhttp://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/phpMyAdmin/libraries/display_export.lib.php?r1=11986&r2=12302&pathrev=12302http://secunia.com/advisories/34430http://secunia.com/advisories/34642http://secunia.com/advisories/35585http://secunia.com/advisories/35635http://security.gentoo.org/glsa/glsa-200906-03.xmlhttp://www.debian.org/security/2009/dsa-1824http://www.mandriva.com/security/advisories?name=MDVSA-2009:115http://www.phpmyadmin.net/home_page/security/PMASA-2009-2.phphttp://www.securityfocus.com/bid/34251
2009-03-26
Published