PT-2005-1597 · Phpmyadmin · Phpmyadmin

Maksymilian Arciemowicz · Publicado 2005-02-24 · Atualizado 2008-09-05 · CVE-2005-0544

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin version 2.6.1

Description The issue allows remote attackers to obtain the full path of the server. This is achieved through direct requests to various PHP files, which reveal the path in a PHP error message. The affected files include sqlvalidator.lib.php, sqlparser.lib.php, select theme.lib.php, select lang.lib.php, relation cleanup.lib.php, header meta style.inc.php, get foreign.lib.php, display tbl links.lib.php, display export.lib.php, db table exists.lib.php, charset conversion.lib.php, ufpdf.php, mysqli.dbi.lib.php, setup.php, and cookie.auth.lib.php.

Recommendations For phpMyAdmin version 2.6.1, consider restricting access to the mentioned PHP files to minimize the risk of exploitation. As a temporary workaround, avoid using direct requests to these files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-0544

Produtos afetados

Phpmyadmin

Referências · 8

• https://osv.dev/vulnerability/CVE-2005-0544 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0544 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0544 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0544 · Nota de Segurança
• http://sourceforge.net/tracker/index.php?func=detail&aid=1149383&group_id=23067&atid=377408 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2005-0544 · Aviso do Fabricante
• http://secunia.com/advisories/14382 · Aviso do Fabricante
• http://gentoo.org/security/en/glsa/glsa-200503-07.xml · Aviso do Fabricante