バナーによると、リモートホストにインストールされているphpMyAdminのバージョンは、「error.php」スクリプトの「error」パラメーターおよび「libraries/auth/cookie.auth.lib.php」内のユーザー入力をサニタイズできないため、2つのクロスサイトスクリプティングの脆弱性の影響を受ける可能性があります。リモートの攻撃者は、これらの脆弱性を悪用して、任意のHTMLおよびスクリプトコードを、影響を受けるアプリケーションのコンテキスト内のユーザーのブラウザで実行させる可能性があります。

According to its banner, the version of phpMyAdmin installed on the remote host may suffer from two cross-site scripting vulnerabilities due to its failure to sanitize user input to the 'error' parameter of the 'error.php' script and in 'libraries/auth/cookie.auth.lib.php'.  A remote attacker may use these vulnerabilities to cause arbitrary HTML and script code to be executed in a user's browser within the context of the affected application.

Several cross-site scripting vulnerabilities have been discovered in phpmyadmin, a set of PHP-scripts to administrate MySQL over the WWW.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-2869     Andreas Kerber and Michal Cihar discovered several     cross-site scripting vulnerabilities in the error page     and in the cookie login.

  - CVE-2005-3300     Stefan Esser discovered missing safety checks in     grab_globals.php that could allow an attacker to induce     phpmyadmin to include an arbitrary local file.

  - CVE-2005-3301     Tobias Klein discovered several cross-site scripting     vulnerabilities that could allow attackers to inject     arbitrary HTML or client-side scripting.

The version in the old stable distribution (woody) has probably its own flaws and is not easily fixable without a full audit and patch session. The easier way is to upgrade it from woody to sarge.

根據標題來判斷，遠端主機上安裝的 phpMyAdmin 版本可能受到兩個跨網站指令碼弱點影響，這是因為其無法清理「error.php」指令碼的「error」參數和「libraries/auth/cookie.auth.lib.php」中的使用者輸入資料。遠端攻擊者可以利用這些弱點，於使用者的瀏覽器中在受影響應用程式的內容中執行任意 HTML 和指令碼。

根据其标题，远程主机上安装的 phpMyAdmin 版本可能受到两个跨站脚本漏洞的影响，这是其未能审查“error.php”脚本的“error”参数和libraries/auth/cookie.auth.lib.php”中的用户输入所致。远程攻击者可能会利用这些漏洞，导致任意 HTML 和脚本代码在受影响应用程序环境中的用户浏览器内执行。

The version of phpMyAdmin installed on the remote host may suffer from two cross-site scripting vulnerabilities due to its failure to sanitize user input to the 'error' parameter of the 'error.php' script and in 'libraries/auth/cookie.auth.lib.php'.  A remote attacker may use these vulnerabilities to cause arbitrary HTML and script code to be executed in a user's browser within the context of the affected application.  

Versions of phpMyAdmin prior to 2.6.4-pl3 contain a flaw that allows attackers to read arbitrary files because of its failure to sanitize the parameter 'usesubform' before using it in several scripts.

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.8.  Mac OS X 10.4.8 contains several security fixes for the following programs :
 - CFNetwork
 - Flash Player
 - ImageIO
 - Kernel
 - LoginWindow
 - Preferences
 - QuickDraw Manager
 - SASL
 - WebCore
 - Workgroup Manager

ID	名稱	產品	系列	已發布	已更新	嚴重性
19519	phpMyAdmin < 2.6.4の複数のXSS	Nessus	CGI abuses : XSS	2005/8/29	2022/4/11	medium
19519	phpMyAdmin < 2.6.4 Multiple XSS	Nessus	CGI abuses : XSS	2005/8/29	2022/4/11	medium
22746	Debian DSA-880-1 : phpmyadmin - several vulnerabilities	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	medium
19519	phpMyAdmin < 2.6.4 多個 XSS	Nessus	CGI abuses : XSS	2005/8/29	2022/4/11	medium
19519	phpMyAdmin < 2.6.4 多个 XSS	Nessus	CGI abuses : XSS	2005/8/29	2022/4/11	medium
3193	phpMyAdmin < 2.6.4-RC1 XSS (deprecated)	Nessus Network Monitor	CGI	2005/8/29	2019/3/6	low
3252	phpMyAdmin < 2.6.4-pl3 'usesubform' Parameter Remote File Inclusion	Nessus Network Monitor	CGI	2005/10/11	2019/3/6	medium
3757	Mac OS X < 10.4.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2006/9/30	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

low

medium

medium