Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2012-0834: phpLDAPadmin query page can run attacker script
CVE-2012-0834 · published 14 years ago
Summary
Versions of phpLDAPadmin up to 1.2.2 let a remote user place their own web script or HTML into the query page. When a staff member views the page, the malicious code runs in their browser, potentially stealing credentials or performing actions as that user. Upgrade phpLDAPadmin to the latest release or apply the vendor's patch, and ensure input filtering is in place.
What to do
- Update debian phpldapadmin to version 1.2.2-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | phpldapadmin |
< 1.2.2-1 Fix: upgrade to 1.2.2-1
|
| Debian:13 | debian | phpldapadmin |
< 1.2.2-1 Fix: upgrade to 1.2.2-1
|
| Debian:14 | debian | phpldapadmin |
< 1.2.2-1 Fix: upgrade to 1.2.2-1
|
| – | phpldapadmin_project | phpldapadmin |
<= 1.2.2 cpe:2.3:a:phpldapadmin_project:phpldapadmin:*:*:*:*:*:*:*:* |
Original advisory text
Cross-site scripting (XSS) vulnerability in lib/QueryRender.php in phpLDAPadmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the base parameter in a query_en...
Cross-site scripting (XSS) vulnerability in lib/QueryRender.php in phpLDAPadmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the base parameter in a query_engine action to cmd.php.
References
- https://security-tracker.debian.org/tracker/CVE-2012-0834 Vendor Advisory
- http://openwall.com/lists/oss-security/2012/02/02/9 Mailing List Third Party Advisory
- http://openwall.com/lists/oss-security/2012/02/03/3 Mailing List Third Party Advisory
- http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadm...
- http://secunia.com/advisories/47852 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:020 Third Party Advisory
- https://sourceforge.net/tracker/index.php?func=detail&aid=3477910&group_id=61828... Exploit Third Party Advisory
Severity
4.3
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published11 Feb 2012
Updated31 Oct 2026
First seen5 Sep 2026
Track software like this
Free during beta