FreeBSD1A0E4CC6-29BF-11DE-BDEB-0030843D3802phpmyadmin -- insufficient output sanitizing when generating configuration file
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
Percentile
90.9%
phpMyAdmin Team reports:
Setup script used to generate configuration can be fooled using a
crafted POST request to include arbitrary PHP code in generated
configuration file. Combined with ability to save files on server,
this can allow unauthenticated users to execute arbitrary PHP code.
This issue is on different parameters than PMASA-2009-3 and it was
missed out of our radar because it was not existing in 2.11.x
branch.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| FreeBSD | any | noarch | phpmyadmin | <ย 3.1.3.2 | UNKNOWN |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
Percentile
90.9%