CVE-2006-6943
phpMyAdmin < 2.9.1 - Path Disclosure via Multiple Scripts and Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-6943. PoCs published by laurent gaffie.
AI-analyzed exploit summary This is a writeup describing multiple input-validation vulnerabilities in phpMyAdmin, including HTML injection, XSS, and information disclosure. It lists various endpoints that are vulnerable but does not provide executable exploit code.
Description
PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_orange/layout.inc.php; and via the (1) lang[], (2) target[], (3) db[], (4) goto[], (5) table[], and (6) tbl_group[] array arguments to (c) index.php, and the (7) back[] argument to (d) sql.php; and an invalid (8) sort_by parameter to (e) server_databases.php and (9) db parameter to (f) db_printview.php.
Exploits (1)
This is a writeup describing multiple input-validation vulnerabilities in phpMyAdmin, including HTML injection, XSS, and information disclosure. It lists various endpoints that are vulnerable but does not provide executable exploit code.