CVE-2008-4775

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the pmd_pdf.php script of phpMyAdmin versions 3.0.0, 2.11.9.2, and 3.0.1 (and possibly others) when the PHP register_globals directive is enabled. The db parameter is not properly sanitized before being reflected in the output, allowing injection of arbitrary HTML and JavaScript [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL containing a db parameter with embedded script code. No authentication is required, and the attack is performed remotely. The only prerequisite is that register_globals is enabled on the target server, which is a deprecated PHP configuration. The attacker simply sends the crafted link to a victim who must be logged into phpMyAdmin for the script to execute in their session context.

Impact

Successful exploitation allows the attacker to execute arbitrary web script or HTML in the victim's browser within the security context of the phpMyAdmin application. This can lead to session hijacking, defacement, or theft of sensitive information displayed in the phpMyAdmin interface.

Mitigation

The vulnerability is fixed in phpMyAdmin version 2.11.9.4 and later [2]. Users should upgrade to the latest available version. As a general security measure, disabling register_globals in PHP configuration mitigates the attack vector. No other workaround is documented [2].