The phpmyadmin update in DSA 1207 introduced a regression. This update corrects this flaw. For completeness, please find below the original advisory text :

  Several remote vulnerabilities have been discovered in phpMyAdmin, a   program to administrate MySQL over the web. The Common   Vulnerabilities and Exposures project identifies the following   problems :

    - CVE-2005-3621       CRLF injection vulnerability allows remote attackers       to conduct HTTP response splitting attacks.

    - CVE-2005-3665       Multiple cross-site scripting (XSS) vulnerabilities       allow remote attackers to inject arbitrary web script       or HTML via the (1) HTTP_HOST variable and (2) various       scripts in the libraries directory that handle header       generation.

    - CVE-2006-1678       Multiple cross-site scripting (XSS) vulnerabilities       allow remote attackers to inject arbitrary web script       or HTML via scripts in the themes directory.

    - CVE-2006-2418       A cross-site scripting (XSS) vulnerability allows       remote attackers to inject arbitrary web script or       HTML via the db parameter of footer.inc.php.

    - CVE-2006-5116       A remote attacker could overwrite internal variables       through the _FILES global variable.

This patch upgrades the phpMyAdmin package to version 2.9.1.1, including fixes for the security problems tracked by the Mitre CVE IDs CVE-2006-3388, CVE-2006-5116, CVE-2006-5117, and CVE-2006-5718.

phpMyAdmin team reports :

We received a security advisory from Stefan Esser (sesser@hardened-php.net) and we wish to thank him for his work.

It was possible to inject arbitrary SQL commands by forcing an authenticated user to follow a crafted link.

The version of phpMyAdmin installed on the remote host allows an unauthenticated attacker to bypass variable blacklisting in its globalization routine and destroy, for example, the contents of session variables.

リモートホストにインストールされているバージョンの phpMyAdmin により、認証されていない攻撃者が、グローバル化ルーチンの変数ブラックリストをバイパスし、例えばセッション変数のコンテンツを破壊できます。

远程主机上安装的 phpMyAdmin 版本允许未经认证的攻击者绕过其全局化例程中的变量黑名单并破坏会话变量的内容等。

遠端主機上安裝的 phpMyAdmin 版本允許未經驗證的攻擊者略過全局化常式中的變數拒絕清單，藉此破壞工作階段變數等內容。

Versions of phpMyAdmin prior to 2.9.1-rc1 are affected by the following vulnerabilities :

 - A series of cross-site request forgery (CSRF) flaws that allow remote attackers to perform unauthorized actions as another user. Specifically, this flaw affects the files 'libraries/common.lib.php', 'session.inc.php', and 'url_generating.lib.php' and is leveraged by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the '_REQUEST' array. (CVE-2006-5116)
 - Insufficient access control in the phpMyAdmin libraries directory under the web root. Exploiting this flaw would allow a remote attacker to obtain sensitive information via direct requests for certain files. (CVE-2006-5117)

The remote host is running phpMyAdmin, a web interface for administering MySQL database servers.  This version of phpMyAdmin is vulnerable to an HTML injection attack as well as several undisclosed vulnerabilities.  The details of the flaws will be released by the vendor; however, they have released a patched version of phpMyAdmin. 

ID	名前	製品	ファミリー	公開日	更新日	深刻度
23656	Debian DSA-1207-2 : phpmyadmin - several vulnerabilities	Nessus	Debian Local Security Checks	2006/11/20	2021/1/4	medium
27395	openSUSE 10 Security Update : phpMyAdmin (phpMyAdmin-2300)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	medium
22487	FreeBSD : phpmyadmin -- CSRF vulnerabilities (19b17ab4-51e0-11db-a5ae-00508d6a62df)	Nessus	FreeBSD Local Security Checks	2006/10/2	2021/1/6	medium
22512	phpMyAdmin < 2.9.1 Multiple Vulnerabilities	Nessus	CGI abuses	2006/10/6	2022/4/11	medium
22512	phpMyAdmin < 2.9.1 の複数の脆弱性	Nessus	CGI abuses	2006/10/6	2022/4/11	medium
22512	phpMyAdmin < 2.9.1 多种漏洞	Nessus	CGI abuses	2006/10/6	2022/4/11	medium
22512	phpMyAdmin < 2.9.1 多種弱點	Nessus	CGI abuses	2006/10/6	2022/4/11	medium
3756	phpMyAdmin < 2.9.1-rc1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2006/9/28	2019/3/6	medium
3882	PHPMyAdmin < 2.9.2-rc2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2007/1/10	2019/3/6	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium

medium