Some vulnerabilities have been reported in phpMyAdmin, which can be exploited by malicious people to conduct cross-site scripting attacks.

1) Input passed via the "field_str" parameter to db_search.php , the "delimiter" parameter to db_sql.php, the "sort" parameter to db_structure.php, the "db" parameter to js/messages.php, the "sort_by" parameter to server_databases.php, the "checkprivs", "dbname", "pred_tablename", "selected_usr[]", "tablename", and "username" parameters to server_privileges.php, the "DefaultLang" parameter to setup/config.php, the "cpurge", "goto", "purge", "purgekey", "table", and "zero_rows" parameters to sql.php, and the "fields[multi_edit][]" parameter to tbl_replace.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in versions prior to 3.3.5.1 and 2.11.10.1.

Solution
Update to version 3.3.5.1 or 2.11.10.1.

Provided and/or discovered by
1) Aung Khant, YGN Ethical Hacker Group
2) Reported by the vendor

Original Advisory
phpMyAdmin:
http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php

Aung Khant:
http://yehg.net/lab/pr0js/advisories/phpmyadmin/%5Bphpmyadmin-3.3.5%5D_cross_site_scripting%28XSS%29

Deep Links
Links available to Secunia VIM customers