Test ID:	1.3.6.1.4.1.25623.1.0.807597
Category:	Web application abuses
Title:	phpMyAdmin Multiple XSS Vulnerabilities (PMASA-2016-11) - Windows
Summary:	phpMyAdmin is prone to multiple cross-site scripting (XSS); vulnerabilities.
Description:	Summary: phpMyAdmin is prone to multiple cross-site scripting (XSS) vulnerabilities. Vulnerability Insight: Multiple flaws are due to: - An input validation error via Host HTTP header, related to the 'libraries/Config.class.php' script. - An input validation error via JSON data, related to the 'file_echo.php' script. - An input validation error related to SQL query in the 'js/functions.js script'. - An input validation error via the initial parameter to the 'libraries/server_privileges.lib.php' script in the user accounts page. - An input validation error via a parameter to the 'libraries/controllers/TableSearchController.class.php' script in the zoom search page. Vulnerability Impact: Successful exploitation will allow remote attackers to inject arbitrary web script or HTML via crafted parameters. Affected Software/OS: phpMyAdmin versions 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5.1. Solution: Update to version 4.0.10.15, 4.4.15.5, or 4.5.5.1 or later. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-2560 Debian Security Information: DSA-3627 (Google Search) http://www.debian.org/security/2016/dsa-3627 http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html SuSE Security Announcement: openSUSE-SU-2016:0663 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html SuSE Security Announcement: openSUSE-SU-2016:0666 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-03/msg00020.html
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.