CVE-2011-4782

Vulnerability

The vulnerability is a cross-site scripting (XSS) issue in the setup interface of phpMyAdmin, specifically in the libraries/config/ConfigFile.class.php file. It affects phpMyAdmin versions 3.4.x prior to 3.4.9. The host parameter is not properly sanitized, allowing injection of arbitrary web script or HTML. [1][4]

Exploitation

An attacker can exploit this by crafting a malicious host parameter and tricking a user into visiting the /setup page. If the config directory exists and is writable, the injected payload can be saved to that directory, making the XSS persistent. The attack requires no authentication but relies on user interaction (visiting the crafted URL). [4]

Impact

Successful exploitation enables the attacker to inject arbitrary web script or HTML into the setup interface. This can lead to information disclosure, session hijacking, or further attacks within the context of the phpMyAdmin setup environment. The impact is limited to users who access the /setup page. [4]

Mitigation

The fix is included in phpMyAdmin version 3.4.9, released on 2011-12-21. Users should upgrade to 3.4.9 or later, or apply the patch from commit 0e707906e69ce90c4852a0fce2a0fac7db86a3cd. As a workaround, ensure the config directory is not writable and avoid visiting the /setup page with untrusted input. [4]