CVE-2010-2958: phpMyAdmin Cross-site Scripting Vulnerability
Summary
CVE-2010-2958: phpMyAdmin Cross-site Scripting vulnerability. Affects phpmyadmin/phpmyadmin versions >= 3.0.0, < 3.3.6. Fixed in 3.3.6. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2010-2958 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
phpMyAdmin is a widely used open-source tool for managing MySQL databases through a web interface. It allows users to perform various database operations such as creating, modifying, and deleting databases and tables, executing SQL queries, and managing users. Despite its popularity, phpMyAdmin has faced several security vulnerabilities over the years, including cross-site scripting (XSS) issues that can compromise user data and application integrity.
Vulnerability Detail
The vulnerability identified as CVE-2010-2958 is a cross-site scripting (XSS) flaw found in the libraries/Error.class.php file of phpMyAdmin versions prior to 3.3.6. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML into the application via error messages related to PHP backtraces. If exploited, this could lead to unauthorized actions being performed on behalf of users, potentially exposing sensitive information or compromising user sessions.
How To Fix
Minimum fixed version
3.3.6
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:3.3.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider implementing input validation and sanitization on error messages to prevent script injection. Additionally, restricting access to the phpMyAdmin interface to trusted IP addresses can help reduce exposure to potential attacks.
Conclusion
CVE-2010-2958 is a significant cross-site scripting vulnerability in phpMyAdmin that can have serious implications if left unaddressed. It is crucial for users to update to the patched version 3.3.6 or later to ensure the security of their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
CVE-2010-2958 is a cross-site scripting vulnerability in phpMyAdmin that allows attackers to inject malicious scripts via error messages.
The vulnerability affects phpMyAdmin versions 3.x before 3.3.6.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized actions, session hijacking, and exposure of sensitive user data.
Yes, you can implement input validation and restrict access to the phpMyAdmin interface as temporary measures.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
