PT-2013-5327 · Phpmyadmin · Phpmyadmin

Publicado

2013-07-29

·

Atualizado

2024-06-15

·

CVE-2013-5003

CVSS v2.0

6.5

Média

VetorAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 3.5.x prior to 3.5.8.2 phpMyAdmin versions 4.0.x prior to 4.0.4.2
Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved through the scale parameter to "pmd pdf.php" or the pdf page number parameter to "schema export.php".
Recommendations For phpMyAdmin versions 3.5.x prior to 3.5.8.2, update to version 3.5.8.2 or later. For phpMyAdmin versions 4.0.x prior to 4.0.4.2, update to version 4.0.4.2 or later. As a temporary workaround, consider restricting access to the "pmd pdf.php" and "schema export.php" scripts until a patch is applied. Avoid using the scale and pdf page number parameters in the affected scripts until the issue is resolved.

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2013-5003
DLA-0014-1
DSA-2975-1
MGASA-2013-0238
OPENSUSE-SU-2024:10054-1

Produtos afetados

Phpmyadmin