CVE-2010-4480

Published: Dec 8, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

error.php in PhpMyAdmin 3.3.8.1, and other versions before 3.4.0-beta1, allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing "@" characters, as demonstrated using "[a@url@page]".

Affected (2)

Products: Phpmyadmin: Phpmyadmin

Phpmyadmin

1 product

Phpmyadmin

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Phpmyadmin Phpmyadmin	Version 3.3.8.1
Phpmyadmin Phpmyadmin	Version 3.3.9.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (20)

http://secunia.com/advisories/42485

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/42725

Source: cve@mitre.org

Vendor Advisory

http://www.debian.org/security/2010/dsa-2139

Source: cve@mitre.org

http://www.exploit-db.com/exploits/15699

Source: cve@mitre.org

Exploit

http://www.mandriva.com/security/advisories?name=MDVSA-2011:000

Source: cve@mitre.org

http://www.phpmyadmin.net/home_page/security/PMASA-2010-9.php

Source: cve@mitre.org

http://www.securityfocus.com/bid/45633

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/3133

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0001

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0027

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/42485