CVE-2007-4306

Name	CVE-2007-4306
Description	Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.10.3 allow remote attackers to inject arbitrary web script or HTML via the (1) unlim_num_rows, (2) sql_query, or (3) pos parameter to (a) tbl_export.php; the (4) session_max_rows or (5) pos parameter to (b) sql.php; the (6) username parameter to (c) server_privileges.php; or the (7) sql_query parameter to (d) main.php. NOTE: vector 5 might be a regression or incomplete fix for CVE-2006-6942.7.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
phpmyadmin (PTS)	jessie, jessie (lts)	4:4.2.12-2+deb8u11	vulnerable
	stretch (security)	4:4.6.6-4+deb9u2	vulnerable
	stretch (lts), stretch	4:4.6.6-4+deb9u3	vulnerable
	bullseye	4:5.0.4+dfsg2-2+deb11u1	vulnerable
	bookworm	4:5.2.1+dfsg-1	vulnerable
	sid, trixie	4:5.2.1+dfsg-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
phpmyadmin	source	sarge	(not affected)
phpmyadmin	source	(unstable)	(unfixed)	unimportant

It seems that this requires knowledge of a unguessable session token.
Confirmed by upstream. Sarge is not affected at all.