PT-2016-6654 · Phpmyadmin+1 · Phpmyadmin+1

Deniz Cevik · Publicado 2014-05-05 · Atualizado 2024-06-15 · CVE-2016-5706

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.x through 4.0.10.15 phpMyAdmin versions 4.4.x through 4.4.15.6 phpMyAdmin versions 4.6.x through 4.6.2

Description The issue allows remote attackers to cause a denial of service via a large array in the scripts parameter in the js/get scripts.js.php file.

Recommendations For phpMyAdmin versions 4.0.x through 4.0.10.15, update to version 4.0.10.16 or later. For phpMyAdmin versions 4.4.x through 4.4.15.6, update to version 4.4.15.7 or later. For phpMyAdmin versions 4.6.x through 4.6.2, update to version 4.6.3 or later.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-399

CWE-400

Identificadores relacionados

ALT-PU-2014-1591

ALT-PU-2016-1758

CVE-2016-5706

DSA-3627-1

GHSA-9RMM-8FP4-26HV

MGASA-2016-0240

OPENSUSE-SU-2024:10054-1

Produtos afetados

Alt Linux

Phpmyadmin

Referências · 237

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmyadmin_null_termination_exec.rb · Exploit
• 🔥 https://github.com/coffeehb/Some-PoC-oR-ExP/blob/master/PhpMyAdmin/phpmyadmin4.6.2_RCE.py · Exploit
• https://github.com/phpmyadmin/phpmyadmin/commit/4767f24ea4c1e3822ce71a636c341e8ad8d07aa6 · Correção
• https://github.com/phpmyadmin/phpmyadmin/commit/abb3685c8702de887988fee31a97ef4d80d856a1 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/805225a28c1428d7809e613c731c2126960e98df · Nota
• https://github.com/phpmyadmin/composer · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1927 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5701 · Nota de Segurança
• https://suse.com/security/cve/CVE-2016-6622 · Nota
• https://suse.com/security/cve/CVE-2014-4986 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5731 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9847 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8669 · Nota de Segurança
• https://suse.com/security/cve/CVE-2016-9859 · Nota
• https://suse.com/security/cve/CVE-2013-4998 · Nota