PT-2006-5854 · Php · Phpmyadmin

Stefan Esser · Publicado 2006-10-02 · Atualizado 2018-10-17 · CVE-2006-5116

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 2.9.1-rc1

Description The issue allows remote attackers to perform unauthorized actions as another user due to multiple cross-site request forgery (CSRF) vulnerabilities. This is related to the direct setting of a token in the URL through dynamic variable evaluation and unsetting arbitrary variables via the REQUEST array. The affected files include libraries/common.lib.php, session.inc.php, and url generating.lib.php.

Recommendations For versions prior to 2.9.1-rc1, update to version 2.9.1-rc1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive functions and variables to minimize the risk of exploitation. Avoid using the REQUEST array to unset arbitrary variables in the affected API endpoints until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-5116

DSA-1207-1

Produtos afetados

Phpmyadmin

Referências · 18

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5116 · Nota
• http://attrition.org/pipermail/vim/2006-October/001067.html · Nota
• http://phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5 · Nota
• https://osv.dev/vulnerability/CVE-2006-5116 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2006-5116 · Aviso do Fabricante
• http://hardened-php.net/advisory_072006.130.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29301 · Nota
• http://secunia.com/advisories/23086 · Nota
• http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html · Aviso do Fabricante
• http://securityfocus.com/bid/20253 · Correção
• http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download · Correção
• http://securityfocus.com/archive/1/447491/100/0/threaded · Nota
• http://secunia.com/advisories/22781 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-5116 · Aviso do Fabricante
• http://securityreason.com/securityalert/1677 · Nota