PRIOn knowledge basePRION:CVE-2010-3055Cross site request forgery (csrf)
7.7 High
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.101 Low
EPSS
Percentile
94.8%
The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.
References
phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=30c83acddb58d3bbf940b5f9ec28abf5b235f4d2
secunia.com/advisories/41058
secunia.com/advisories/41185
sourceforge.net/tracker/?func=detail&aid=3045132&group_id=23067&atid=377408
www.debian.org/security/2010/dsa-2097
www.mandriva.com/security/advisories?name=MDVSA-2010:163
www.securityfocus.com/bid/42591
www.vupen.com/english/advisories/2010/2223
www.vupen.com/english/advisories/2010/2231
www.phpmyadmin.net/home_page/security/PMASA-2010-4.php
Related
7.7 High
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.101 Low
EPSS
Percentile
94.8%