This host is installed with phpMyAdmin and is prone to cross-site scripting(XSS) vulnerability.

Successful exploitation will allow remote attackers to execute arbitrary HTML and script code in a user's browser session in the context of an affected site. Impact Level: Application

Upgrade to phpMyAdmin 4.2.13.1 or later. For updates refer to http://www.phpmyadmin.net

Input passed via the 'url' parameter to url.php script is not validated before returning it to users.

phpMyAdmin 4.2.x versions before 4.2.13.1

Send a crafted data via HTTP GET request and check whether it is able to read cookie or not.

• http://blog.elevenpaths.com/2014/12/phpmyadmin-fixes-xss-detected-by.html?m=1
• http://osvdb.org/115323
• http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php
• http://xforce.iss.net/xforce/xfdb/99137

---

Updated on 2015-03-25