PT-2005-5035 · Phpmyadmin · Phpmyadmin

Lwang · Publicado 2005-12-19 · Atualizado 2025-01-16 · CVE-2005-4349

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions phpMyAdmin version 2.7.0

Description A SQL injection issue allows remote authenticated users to execute arbitrary SQL commands via the dbname and checkprivs parameters in the server privileges.php file. However, the vendor and a third party have disputed this issue, stating that the program's main task is to support query execution by authenticated users and no external attack scenario exists without an auto-login configuration.

Recommendations For phpMyAdmin version 2.7.0, consider restricting access to the server privileges.php file and limiting the use of the dbname and checkprivs parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2005-4349

Produtos afetados

Phpmyadmin

Referências · 12

• https://security-tracker.debian.org/tracker/CVE-2005-4349 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4349 · Nota
• http://marc.info/?l=bugtraq&m=113486637512821&w=2 · Nota
• http://securityfocus.com/archive/1/419832/100/0/threaded · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-4349 · Aviso do Fabricante
• http://vupen.com/english/advisories/2005/2995 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-4349 · Nota de Segurança
• http://securityreason.com/securityalert/270 · Nota
• http://secunia.com/advisories/18113 · Aviso do Fabricante
• http://securityfocus.com/archive/1/419829/100/0/threaded · Nota
• https://t.me/cvenotify/107697 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2005-4349 · Aviso do Fabricante