CVE-2012-0834 Cross-site scripting (XSS) vulnerability in lib/QueryRender.php in phpLDAPadmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the base parameter in a query_engin...
MediumCVSS 4.3
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in lib/QueryRender.php in phpLDAPadmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the base parameter in a query_engine action to cmd.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/phpldapadmin(Debian:12) | < 1.2.2-1 | 1.2.2-1 |
| debian/phpldapadmin(Debian:13) | < 1.2.2-1 | 1.2.2-1 |
| debian/phpldapadmin(Debian:14) | < 1.2.2-1 | 1.2.2-1 |
| phpldapadmin project phpldapadmin | <= 1.2.2 | No fix listed |
References
- Debian Security Tracker CVE-2012-0834 vendor-advisory
- bugs.debian.org issue-tracking
- [oss-security] 20120202 CVE request: phpldapadmin "base" Cross-Site Scripting Vulnerability mailing-list third-party-advisory
- [oss-security] 20120203 Re: CVE request: phpldapadmin "base" Cross-Site Scripting Vulnerability mailing-list third-party-advisory
- phpldapadmin.git.sourceforge.net
- 47852 third-party-advisory
- MDVSA-2012:020 third-party-advisory vendor-advisory
- sourceforge.net exploit third-party-advisory