CVE-2007-1395

Name	CVE-2007-1395
Description	Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary JavaScript or HTML in a (1) db or (2) table parameter value followed by an uppercase </SCRIPT> end tag, which bypasses the protection against lowercase </script>.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1370-1, DSA-1370-2

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
phpmyadmin (PTS)	bullseye	4:5.0.4+dfsg2-2+deb11u1	fixed
	bookworm	4:5.2.1+dfsg-1	fixed
	sid, trixie	4:5.2.2-really5.2.2+20241130+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
phpmyadmin	source	sarge	4:2.6.2-3sarge5		DSA-1370-2
phpmyadmin	source	etch	4:2.9.1.1-4		DSA-1370-2
phpmyadmin	source	(unstable)	4:2.10.0.2-1	medium

Notes

[sarge] - phpmyadmin <not-affected> (Vulnerable code not present)
https://www.phpmyadmin.net/security/PMASA-2007-2/
https://github.com/phpmyadmin/phpmyadmin/commit/6215e201eb98226837954059f6c99c9aa1c55a9a