CVE-2008-3197 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3197): Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the "Creating a Database" functionality (db_create.php) and (2) unspecified vectors that modify the connection character set.
There are even more issues: http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6 Secunia writes [1]: Aung Khant has reported two vulnerabilities in phpMyAdmin, which can be exploited by malicious local users to conduct cross-site scripting attacks, and by malicious people to conduct spoofing attacks. 1) Many scripts except for index.php do not check if they are linked into another site's frames. This can potentially be used for spoofing and phishing attacks. 2) Input from the config/config.inc.php configuration file to scripts/setup.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. [1] http://secunia.com/advisories/31263/ web-apps, please bump.
Bumped to 2.11.8. Target archs: alpha amd64 hppa ppc ppc64 sparc x86
Stable for HPPA.
alpha/sparc/x86 stable
dev-db/phpmyadmin-2.11.8 stable on ppc64
ppc stable
amd64 stable
Ready for vote, I vote NO.
NO too and closing.
