phpMoAdmin 1.1.5: Attackers can inject malicious scripts in web browsers

Summary

An attacker can inject malicious scripts in users' web browsers, potentially allowing them to steal sensitive information or take control of users' accounts, by manipulating a parameter in a web request to the phpMoAdmin interface. This can happen without needing a password or other authentication. To protect your users, update phpMoAdmin to the latest version.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
phpmoadmin	phpmoadmin	1.1.5	–

Original title

phpMoAdmin 1.1.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the collection parameter. Attackers can send ...

Original description

phpMoAdmin 1.1.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the collection parameter. Attackers can send GET requests to moadmin.php with script payloads in the collection parameter during collection creation to execute arbitrary JavaScript in users' browsers.

nvd CVSS3.1 6.1

nvd CVSS4.0 5.3

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

http://www.phpmoadmin.com/ Product
https://www.exploit-db.com/exploits/46082 Exploit VDB Entry
https://www.vulncheck.com/advisories/phpmoadmin-stored-cross-site-scripting-via-... Third Party Advisory