PT-2005-1615 · Php · Phpmyadmin

Maksymilian Arciemowicz · Publicado 2005-02-27 · Atualizado 2017-07-11 · CVE-2005-0567

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyAdmin version 2.6.1

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by modifying specific parameters to reference a URL on a remote web server that contains the malicious code. The parameters in question are the theme parameter to phpmyadmin.css.php and the cfg[Server][extension] parameter to database interface.lib.php.

Recommendations For phpMyAdmin version 2.6.1, consider restricting access to the phpmyadmin.css.php and database interface.lib.php files until a patch is available. As a temporary workaround, avoid using the theme and cfg[Server][extension] parameters in the affected files to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-0567

Produtos afetados

Phpmyadmin

Referências · 11

• http://sourceforge.net/tracker/index.php?func=detail&aid=1149381&group_id=23067&atid=377408 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19465 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0567 · Nota
• https://security-tracker.debian.org/tracker/CVE-2005-0567 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-0567 · Nota de Segurança
• http://secunia.com/advisories/14382 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2005-0567 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0567 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=110929725801154&w=2 · Nota
• http://phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1 · Aviso do Fabricante
• http://securityfocus.com/bid/12645 · Correção