CVE-2009-1150 — Cross-site Scripting in Phpmyadmin

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.7%
top 26.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PhpmyadminDebian Phpmyadmin
Timeline
PublishedMar 26
Latest updateMay 2

Description

Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pma_db_filename_template cookie.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/phpmyadmin< phpmyadmin 4:3.1.3.1-1 (bookworm)
▶Debianphpmyadmin/phpmyadmin< 4:3.1.3.1-1+3
▶NVDphpmyadmin/phpmyadmin31 versions+30

Patches

Patch: www.phpmyadmin.net ↗Patch: www.phpmyadmin.net ↗

🔴Vulnerability Details

2
GHSA
GHSA-pgqx-hcp9-24pq: Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export↗2022-05-02
▶
OSV
CVE-2009-1150: Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export↗2009-03-26
▶

📋Vendor Advisories

2
Debian
CVE-2009-1150: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_...↗2009
▶
Red Hat
phpMyAdmin: multiple security fixes in 3.1.3.1 (PMASA-2009-{1,2,3})↗
▶