Secunia

Stefan Esser has reported a vulnerability in phpMyAdmin, which can be exploited by malicious people to conduct cross-site scripting attacks, disclose sensitive information, and compromise a vulnerable system.

The vulnerability is caused due to an error in the register_globals emulation layer in "grab_globals.php" where the "import_blacklist" variable is not properly protected from being overwritten. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site, and include arbitrary files from external and local resources.

This is related to vulnerability #1 in:
SA17289

The vulnerability has been reported in version 2.7.0.

Solution
Update to version 2.7.0-pl1.
Further details available in Customer Area

Provided and/or discovered by
Stefan Esser, Hardened-PHP Project

Changelog
Further details available in Customer Area

Original Advisory
Hardened-PHP Project:
http://www.hardened-php.net/advisory_252005.110.html

phpMyAdmin:
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area