The Spiderlabs team at Trustwave published a new advisory for a Cross-Side-Scripting (XSS) found in phpMyAdmin 3.4.8 and previous versions. phpMyAdmin is an open source tool developed in PHP to manage and administer MySQL databases remotely.
The vulnerability was discovered by Jason Leyrer who is a member of the Trustwave SpiderLabs Research team. Jason discovered that the 'Servers-0-host' input field in the phpMyAdmin setup interface was unsanitized and an attacker could potentially store malicious javascript into the config file (persistent XSS) when the directory is writeable. phpMyAdmin has confirmed Jason's findings and the organization has released phpMyAdmin 3.4.9 to address this vulnerability. phpMyAdmin advisory can viewed by visiting:
LevelBlue secures what's next with intelligence-led security delivering visibility and speed to stop threats faster.
As the world’s largest and most analyst-recognized pure-play managed security services provider,
our AI-powered managed services and cyber expertise across managed, advisory, and incident response services help clients operate with confidence.
Learn more about us.
