phpMoAdmin Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in phpMoAdmin version 1.1.5. This vulnerability allows unauthenticated attackers to inject malicious scripts by manipulating the collection parameter. During the creation of a collection, attackers can send GET requests to moadmin.php with script payloads in the collection parameter, which will then be executed as arbitrary JavaScript in the browsers of users.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, create a collection in phpMoAdmin 1.1.5 and include a script payload in the collection parameter. Once the collection is created, the injected script will execute in the user's browser.