phpMyAdmin left.php Code Injection

2004-06-28T21:57:52
ID OSVDB:7314
Type osvdb
Reporter Nasir Simbolon(nasir@kecapi.com)
Modified 2004-06-28T21:57:52

Description

Vulnerability Description

phpMyAdmin contains a flaw that will allow a remote attacker to inject arbitrary PHP code. If $cfg['LeftFrameLight'] in the 'config.lib.php' script is set to false, a remote attacker could supply a specially-crafted HTTP request containing malicious PHP code in the eval function of the 'left.php' script resulting in a loss of integrity.

Solution Description

Upgrade to version 2.5.7 Patch Level 1, 2.6.0-rc1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Short Description

phpMyAdmin contains a flaw that will allow a remote attacker to inject arbitrary PHP code. If $cfg['LeftFrameLight'] in the 'config.lib.php' script is set to false, a remote attacker could supply a specially-crafted HTTP request containing malicious PHP code in the eval function of the 'left.php' script resulting in a loss of integrity.

References:

Vendor URL: http://www.phpmyadmin.net Vendor Specific Solution URL: http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html Vendor Specific Advisory URL Security Tracker: 1010614 Secunia Advisory ID:11974 Related OSVDB ID: 7315 Other Advisory URL: http://eagle.kecapi.com/sec/fd/phpMyAdmin.html Other Advisory URL: http://www.securiteam.com/unixfocus/5QP040ADFW.html Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html ISS X-Force ID: 16542 CVE-2004-2631 Bugtraq ID: 10629