A stored cross-site scripting vulnerability in phpMoAdmin 1.1.5 allows unauthenticated attackers to execute arbitrary JavaScript in the browsers of administrators or other users.

This is a stored cross-site scripting (CWE-79) vulnerability occurring in the collection parameter. Unauthenticated attackers can inject malicious scripts into the application by sending a crafted GET request to moadmin.php during the collection creation process, which the application fails to neutralize.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to session hijacking, the theft of sensitive session cookies, or unauthorized actions performed on behalf of an authenticated user. Given the CVSS score of 7.2, this flaw represents a high risk to application integrity and user security, as it provides a direct path for attackers to compromise administrative sessions.

Immediate Action: As there is currently no official patch available for phpMoAdmin 1.1.5, administrators should restrict access to the application interface to trusted internal networks only.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests directed at moadmin.php, specifically looking for script tags or encoded characters within the collection parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block XSS patterns in URL parameters, which can provide a virtual patch for this vulnerability.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 46082.

The presence of a publicly available proof-of-concept increases the likelihood of exploitation by malicious actors. Because an official patch is missing, organizations must isolate the phpMoAdmin interface from the public internet and implement strict access controls. Immediate defensive measures, such as WAF rule deployment, are required to mitigate the risk of cross-site scripting attacks against your users.