Secunia

Some vulnerabilities have been reported in phpMyAdmin, which can be exploited by malicious people to conduct cross-site scripting and HTTP response splitting attacks.

1) Some input passed to "libraries/header_http.inc.php" isn't properly sanitised before being returned to the user. This can be exploited to include arbitrary HTTP headers in a response sent to the user.

Successful exploitation requires that "register_globals" is enabled.

It is also possible to disclose the full path to certain scripts by accessing them directly.

The vulnerability has been reported in versions prior to 2.6.4-pl4 and in version 2.7.0-beta1.

2) Input passed to the "title" parameter, and some unspecified parameters in the table creation dialog and cookie-based login panel isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Solution
Update to version 2.6.4-pl4.
Further details available in Customer Area

Provided and/or discovered by
1) Toni Koivunen
2) Reported by vendor

Changelog
Further details available in Customer Area

Original Advisory
Toni Koivunen:
http://www.fitsec.com/advisories/FS-05-02.txt

phpMyAdmin:
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-7

Deep Links
Links available in Customer Area