A phpMyAdmin security announcement reports :

We received two bug reports by Maksymilian Arciemowicz about those vulnerabilities and we wish to thank him for his work. The vulnerabilities apply to those points :

- css/phpmyadmin.css.php was vulnerable against $cfg and GLOBALS variable injections. This way, a possible attacker could manipulate any configuration parameter. Using phpMyAdmin's theming mechanism, he was able to include arbitrary files. This is especially dangerous if php is not running in safe mode.

- A possible attacker could manipulate phpMyAdmin's localized strings via the URL and inject harmful JavaScript code this way, which could be used for XSS attacks.

インストールされているバージョンのphpMyAdminは、ライブラリおよびテーマとして使用されるいくつかのPHPスクリプトでユーザー入力をサニタイズできないため、複数のクロスサイトスクリプティングの脆弱性の影響を受けます。リモートの攻撃者が、これらの問題を利用して、任意のコードをユーザーのブラウザで実行し、認証用のクッキーを盗んだりする可能性があります。

The installed version of phpMyAdmin suffers from multiple cross-site scripting vulnerabilities due to its failure to sanitize user input in several PHP scripts used as libraries and themes.  A remote attacker may use these issues to cause arbitrary code to be executed in a user's browser, to steal authentication cookies and the like.

The remote host is affected by the vulnerability described in GLSA-200503-07 (phpMyAdmin: Multiple vulnerabilities)

    phpMyAdmin contains several security issues:
    Maksymilian Arciemowicz has discovered multiple variable injection     vulnerabilities that can be exploited through '$cfg' and 'GLOBALS'     variables and localized strings     It is possible to force phpMyAdmin to disclose information in error     messages     Failure to correctly escape special characters   Impact :

    By sending a specially crafted request, an attacker can include and     execute arbitrary PHP code or cause path information disclosure.
    Furthermore the XSS issue allows an attacker to inject malicious script     code, potentially compromising the victim's browser. Lastly the     improper escaping of special characters results in unintended privilege     settings for MySQL.
  Workaround :

    There is no known workaround at this time.

安裝的 phpMyAdmin 版本受到多個跨網站指令碼弱點影響，這是應用程式未清理數個 PHP 指令碼中用作程式庫和主題的使用者輸入所致。遠端攻擊者可利用這些問題，在使用者的瀏覽器中執行任意程式碼、竊取驗證 Cookie 等。

安装的 phpMyAdmin 版本受到多个跨站脚本漏洞的影响，这是其未能审查用作库和主题的多个 PHP 脚本中的用户输入所致。远程攻击者可利用这些问题，造成在用户的浏览器中执行任意代码、窃取身份验证 Cookie 等。

The remote host is running phpMyAdmin, an open-source software written in PHP to handle the administration of MySQL over the Web.
The remote version of this software is vulnerable to arbitrary command execution due to a lack of user-supplied data sanitization.
In addition, the remote host is vulnerable to multiple remote Cross-Site Scripting (XSS) flaws. An attacker exploiting these flaws would need to be able to convince a user into clicking on a malicious URL.  Upon successful exploitation, the attacker would be able to steal credentials or execute code within the browser.
Thirdly, the remote host is vulnerable to a flaw in the way that it handles user-supplied variables that are used within included files.  An attacker exploiting this flaw would pass malicious data to the server that the server would then include within the executing script code.  A successful exploit would result in the attacker being able to execute arbitrary code on the server. 

ID	名前	製品	ファミリー	公開日	更新日	深刻度
19016	FreeBSD : phpmyadmin -- arbitrary file include and XSS vulnerabilities (882ef43b-901f-11d9-a22c-0001020eed82)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	high
17220	phpMyAdmin < 2.6.1 pl2ライブラリおよびテーマの複数のXSS	Nessus	CGI abuses : XSS	2005/2/25	2022/4/11	medium
17220	phpMyAdmin < 2.6.1 pl2 Libraries and Themes Multiple XSS	Nessus	CGI abuses : XSS	2005/2/25	2022/4/11	medium
17263	GLSA-200503-07 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2005/3/4	2021/1/6	medium
17220	phpMyAdmin < 2.6.1 pl2 程式庫和主題多個 XSS 弱點	Nessus	CGI abuses : XSS	2005/2/25	2022/4/11	medium
17220	phpMyAdmin < 2.6.1 pl2 库和主题多个 XSS	Nessus	CGI abuses : XSS	2005/2/25	2022/4/11	medium
2452	phpMyAdmin < 2.6.1-pl1 RCE	Nessus Network Monitor	CGI	2004/12/13	2019/3/6	high

検出

プラグインの検索

high

medium

medium

medium

medium

medium

high