CVE-2010-2958
Description
Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAdmin 3.x before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to a PHP backtrace and error messages (aka debugging messages), a different vulnerability than CVE-2010-3056.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
An XSS flaw in phpMyAdmin 3.x before 3.3.6 allows attackers to inject arbitrary script via debug error messages and PHP backtraces.
Vulnerability
Cross-site scripting (XSS) vulnerability exists in libraries/Error.class.php in phpMyAdmin versions 3.x prior to 3.3.6. The bug is triggered when the application generates debugging messages containing a PHP backtrace and error messages. An attacker can inject arbitrary web script or HTML through vectors related to this backtrace information [1][2][3].
Exploitation
To exploit, the attacker needs to craft a malicious URL or input that triggers a PHP error while the application is set to display debug/error messages. No authentication is required if the phpMyAdmin instance is publicly accessible and error reporting is enabled. The injected script is processed by the browser of any user viewing the error page [1][4].
Impact
Successful exploitation leads to arbitrary script execution in the context of the victim's session within phpMyAdmin. This can result in data theft, session hijacking, or further attacks against the database management system. The impact is limited to the browser and user session, not the server directly [1].
Mitigation
Upgrade to phpMyAdmin version 3.3.6 or later, which includes the fix from commit 133a77fac7d31a38703db2099a90c1b49de62e37 [2][3]. If upgrading is not possible, disable error reporting or access to phpMyAdmin until the patch can be applied [4].
AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
phpmyadmin/phpmyadminPackagist | >= 3.0.0, < 3.3.6 | 3.3.6 |
Affected products
37cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*+ 35 more
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*
- (no CPE)range: <3.3.6
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
9- www.phpmyadmin.net/home_page/security/PMASA-2010-6.phpnvdPatchVendor AdvisoryWEB
- www.vupen.com/english/advisories/2010/2242nvdPatchVendor Advisory
- secunia.com/advisories/41206nvdVendor Advisory
- github.com/advisories/GHSA-frv8-xjcp-hrm2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2010-2958ghsaADVISORY
- phpmyadmin.git.sourceforge.net/git/gitweb.cginvdWEB
- phpmyadmin.git.sourceforge.net/git/gitweb.cgighsaWEB
- www.openwall.com/lists/oss-security/2010/09/01/2nvdWEB
- www.openwall.com/lists/oss-security/2010/09/01/3nvdWEB
News mentions
0No linked articles in our index yet.