PT-2011-3907 · Phpmyadmin · Phpmyadmin

Frans Pehrson

·

Publicado

2011-07-14

·

Atualizado

2022-05-14

·

CVE-2011-2508

CVSS v4.0

7.4

Alta

VetorAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 3.x prior to 3.3.10.2 phpMyAdmin versions 3.4.x prior to 3.4.3.1
Description The issue allows remote authenticated users to include and execute arbitrary local files. This is possible when a certain MIME transformation feature is enabled. The vulnerability can be exploited via a .. (dot dot) in a GLOBALS[mime map][$meta->name][transformation] parameter.
Recommendations For phpMyAdmin versions 3.x prior to 3.3.10.2, update to version 3.3.10.2 or later. For phpMyAdmin versions 3.4.x prior to 3.4.3.1, update to version 3.4.3.1 or later. As a temporary workaround, consider disabling the MIME transformation feature until a patch is available.

Exploit

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2011-2508
DSA-2286-1
GHSA-Q6VW-39CG-WJJF

Produtos afetados

Phpmyadmin