A phpMyAdmin security announcement reports :

The convcharset parameter was not correctly validated, opening the door to a XSS attack.

安装的 phpMyAdmin 版本受到一个跨站脚本漏洞的影响，这是其未能审查用户针对“index.php”脚本的“convcharset”参数的输入所致。远程攻击者可利用这些漏洞，造成在用户的浏览器中执行任意代码、窃取身份验证 Cookie 等。

安裝的 phpMyAdmin 版本受到一個跨網站指令碼弱點影響，這是因為其無法清理「index.php」指令碼中「convcharset」參數的使用者輸入資料。遠端攻擊者可利用這些弱點，在使用者的瀏覽器中執行任意程式碼，以竊取驗證 Cookie 等。

インストールされているバージョンのphpMyAdminは、「index.php」スクリプトの「convcharset」パラメーターに対するユーザー入力のサニタイズに失敗するため、クロスサイトスクリプティングの脆弱性の影響を受けます。リモートの攻撃者が、これらの脆弱性を利用して、任意のコードをユーザーのブラウザで実行し、認証クッキーを盗む可能性があります。

The installed version of phpMyAdmin suffers from a cross-site scripting vulnerability due to its failure to sanitize user input to the 'convcharset' parameter of the 'index.php' script.  A remote attacker may use these vulnerabilities to cause arbitrary code to be executed in a user's browser to steal authentication cookies and the like.

The remote host is affected by the vulnerability described in GLSA-200504-08 (phpMyAdmin: XSS vulnerability)

    Oriol Torrent Santiago has discovered that phpMyAdmin fails to validate     input to the 'convcharset' variable, rendering it vulnerable to     cross-site scripting attacks.
  Impact :

    By sending a specially crafted request, an attacker can inject and     execute malicious script code, potentially compromising the victim's     browser.
  Workaround :

    There is no known workaround at this time.

The remote host is running phpMyAdmin, an open-source software written in PHP to handle the administration of MySQL over the Web.  The remote host is vulnerable to a remote Cross-Site Scripting (XSS) flaw.  An attacker exploiting these flaws would be need to be able to convince a user to click on a malicious URL.  Upon successful exploitation, the attacker would be able to steal credentials or execute code within the browser.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
19343	FreeBSD : phpmyadmin -- XSS vulnerability (58247a96-01c8-11da-bc08-0001020eed82)	Nessus	FreeBSD Local Security Checks	2005/8/1	2021/1/6	medium
17689	phpMyAdmin index.php convcharset 参数 XSS	Nessus	CGI abuses : XSS	2005/4/5	2022/4/11	medium
17689	phpMyAdmin index.php convcharset 參數 XSS	Nessus	CGI abuses : XSS	2005/4/5	2022/4/11	medium
17689	phpMyAdmin index.phpのconvcharsetパラメーターのXSS	Nessus	CGI abuses : XSS	2005/4/5	2022/4/11	medium
17689	phpMyAdmin index.php convcharset Parameter XSS	Nessus	CGI abuses : XSS	2005/4/5	2022/4/11	medium
18013	GLSA-200504-08 : phpMyAdmin: XSS vulnerability	Nessus	Gentoo Local Security Checks	2005/4/12	2021/1/6	medium
2787	phpMyAdmin < 2.6.2-RC1 RCE	Nessus Network Monitor	CGI	2005/4/4	2019/3/6	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium