6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
0.973 High
EPSS
Percentile
99.8%
Added: 05/20/2013
CVE: CVE-2013-3238
BID: 59460
OSVDB: 92793
phpMyAdmin is a free software tool, written in PHP, designed to handle the administration of MySQL over the Web.
phpMyAdmin before 3.5.8.1 is vulnerable to code injection as a result of failure to sanitize input passed via the **from_prefix**
parameter passed to **preg_replace()**
in **libraries/mult_submits.inc.php**
. As a result, an authenticated remote attacker could potentially execute arbitrary code.
Upgrade to phpMyAdmin 3.5.8.1 or newer.
<http://www.phpmyadmin.net/home_page/security/PMASA-2013-2.php>
This exploit was tested against phpMyAdmin Devel Team phpMyAdmin 3.5.8 on CentOS 6 (with Exec-Shield Enabled).
Netcat (nc) must be installed on the target.
Exploit requires a valid path to phpMyAdmin and valid user credentials for phpMyAdminβs web interface.
Only phpMyAdmin running on a PHP version before 5.4.7 is vulnerable. Newer PHP versions will generate a warning.
Linux