phpMyBackupPro path traversal vulnerability (CNVD-2017-30647)

phpMyBackupPro is a free web-based MySql backup tool. The tool supports automatic backup, timed backup, off-site backup MySql database. A directory traversal vulnerability exists in the getfile.php file in phpMyBackupPro versions 2.1 through 2.5. A remote attacker can read arbitrary files with th...

phpMyBackupPro Path Traversal Vulnerability

phpMyBackupPro is a free web-based MySql backup tool. The tool supports automatic backup, timed backup, off-site backup MySql database. A directory traversal vulnerability exists in the getfile.php file in phpMyBackupPro versions 2.1 through 2.4. A remote attacker can read arbitrary files with th...

Directory traversal

Directory traversal vulnerability in getfile.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this...

CVE-2015-4180

Directory traversal vulnerability in getfile.php in phpMyBackupPro 2.1 through 2.4 allows remote attackers to read arbitrary files via a .. dot dot in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this...

CVE-2015-4181

Directory traversal vulnerability in getfile.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this...

CVE-2015-4181

CVE-2015-4181 affects phpMyBackupPro versions 2.1–2.5 (get_file.php) with a directory traversal via the view parameter, enabling remote attackers to read arbitrary files. The issue is documented across multiple sources (NVD/NVD-linked CNVD entries) as a path-traversal vulnerability in get_file.ph...

CVE-2015-4180

CVE-2015-4180 is a directory-traversal vulnerability in phpMyBackupPro get_file.php for versions 2.1–2.4 that allows remote attackers to read arbitrary files via .. in the view parameter. The issue stems from an incomplete fix to CVE-2009-4050. Some sources extend exposure to 2.5 (as per related ...

CVE-2015-4181

Directory traversal vulnerability in getfile.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this...

CVE-2015-4180

Directory traversal vulnerability in getfile.php in phpMyBackupPro 2.1 through 2.4 allows remote attackers to read arbitrary files via a .. dot dot in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this...

PT-2017-6742

Name of the Vulnerable Software and Affected Versions phpMyBackupPro versions 2.1 through 2.5 Description The issue allows remote attackers to read arbitrary files via a .. dot dot in the view parameter in the get file.php file. This is due to an incomplete fix. Recommendations For phpMyBackupPro...

PT-2017-6741

Name of the Vulnerable Software and Affected Versions phpMyBackupPro versions 2.1 through 2.4 Description The issue allows remote attackers to read arbitrary files via a .. dot dot in the view parameter in the get file.php file. This is due to an incomplete fix. Recommendations For phpMyBackupPro...

CVE-2015-4181: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in getfile.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this...

CVE-2015-4180: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in getfile.php in phpMyBackupPro 2.1 through 2.4 allows remote attackers to read arbitrary files via a .. dot dot in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this...

Input validation

phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to scheduled.php, and making requests to injected scripts, or by injecting PHP into a PHP configurati...

Design/Logic Flaw

phpMyBackupPro 2.5 and earlier does not properly sanitize input strings, which allows remote authenticated users to execute arbitrary PHP code by storing a crafted string in a user configuration file...

CVE-2015-3639

phpMyBackupPro 2.5 and earlier does not properly sanitize input strings, which allows remote authenticated users to execute arbitrary PHP code by storing a crafted string in a user configuration file...

CVE-2015-3640

phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users with knowledge of a web-accessible and web-writeable directory on the target system to inject and execute arbitrary PHP scripts by injecting scripts via the pat...

CVE-2015-3638

phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to scheduled.php, and making requests to injected scripts, or by injecting PHP into a PHP configurati...

CVE-2015-3640

phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users with knowledge of a web-accessible and web-writeable directory on the target system to inject and execute arbitrary PHP scripts by injecting scripts via the pat...

CVE-2015-3638

phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to scheduled.php, and making requests to injected scripts, or by injecting PHP into a PHP configurati...