Vulnerability Name:

CVE-2007-5977 (CCN-38404)

Assigned:2007-11-09
Published:2007-11-09
Updated:2017-07-29
Summary:Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942.
CVSS v3 Severity:2.6 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
2.1 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:N/I:P/A:N)
1.8 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:S/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2007-5977

Source: CCN
Type: SA27630
phpMyAdmin Database Name SQL Injection and Script Insertion

Source: SECUNIA
Type: Patch, Vendor Advisory
27630

Source: SECUNIA
Type: Vendor Advisory
27753

Source: CONFIRM
Type: Patch
http://sourceforge.net/project/shownotes.php?release_id=553333

Source: CCN
Type: The DigiTrust Group Advisory #071108a
phpMyAdmin "db_create.php" persistent cross-site scripting vulnerability

Source: MISC
Type: UNKNOWN
http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html

Source: CCN
Type: GLSA-200903-32
phpMyAdmin: Multiple vulnerabilities

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2007:229

Source: CCN
Type: OSVDB ID: 38714
phpMyAdmin db_create.php db Parameter XSS

Source: CCN
Type: phpMyAdmin Web site
phpMyAdmin

Source: CCN
Type: phpMyAdmin security announcement PMASA-2007-7
XSS vulnerabilities

Source: CONFIRM
Type: Patch
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7

Source: BID
Type: UNKNOWN
26512

Source: CCN
Type: BID-26512
phpMyAdmin DB_Create.PHP Multiple Input Validation Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2007-3824

Source: XF
Type: UNKNOWN
phpmyadmin-dbcreate-xss(38404)

Source: XF
Type: UNKNOWN
phpmyadmin-dbcreate-xss(38404)

Source: FEDORA
Type: UNKNOWN
FEDORA-2007-3666

Vulnerable Configuration:Configuration 1:
  • cpe:/a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:* (Version <= 2.11.2)

    • * Denotes that component is vulnerable
    BACK
    phpmyadmin phpmyadmin *