PT-2001-2205 · Php · Phpmyadmin

Publicado 2001-07-31 · Atualizado 2009-04-03 · CVE-2001-1060

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 2.2.0rc3 and earlier

Description The issue allows remote attackers to execute arbitrary commands by inserting them into specific arguments in certain PHP files. This can be done by inserting commands into the strCopyTableOK argument in tbl copy.php or the strRenameTableOK argument in tbl rename.php.

Recommendations For phpMyAdmin versions 2.2.0rc3 and earlier, consider upgrading to a version that is not affected by this issue. As a temporary workaround, restrict access to the tbl copy.php and tbl rename.php files to minimize the risk of exploitation. Avoid using the strCopyTableOK and strRenameTableOK arguments in these files until the issue is resolved.

Correção

Identificadores relacionados

CVE-2001-1060

Produtos afetados

Phpmyadmin

Referências · 5

• http://securityfocus.com/bid/3121 · Correção
• http://freshmeat.net/redir/phpmyadmin/8001/url_changelog · Nota
• http://securityfocus.com/archive/1/200596 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1060 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-1060 · Nota de Segurança