PT-2016-7006 · Phpmyadmin+2 · Phpmyadmin+2

E3Amn2L

+1

·

Publicado

2014-05-05

·

Atualizado

2024-06-15

·

CVE-2016-6631

CVSS v2.0

8.5

Alta

VetorAV:N/AC:M/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.x prior to 4.0.10.17 phpMyAdmin versions 4.4.x prior to 4.4.15.8 phpMyAdmin versions 4.6.x prior to 4.6.4
Description An issue in phpMyAdmin allows a user to execute a remote code execution attack against a server when phpMyAdmin is run as a CGI application. Under certain server configurations, a user can pass a query string that is executed as a command-line argument by the file generator plugin.sh.
Recommendations For versions 4.0.x prior to 4.0.10.17, update to version 4.0.10.17 or later. For versions 4.4.x prior to 4.4.15.8, update to version 4.4.15.8 or later. For versions 4.6.x prior to 4.6.4, update to version 4.6.4 or later.

Exploit

Correção

RCE

OS Command Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

ALT-PU-2014-1591
ALT-PU-2016-2421
CVE-2016-6631
DLA-1821-1
DLA-626-1
MGASA-2016-0291
OPENSUSE-SU-2016_2168-1
OPENSUSE-SU-2024:10054-1

Produtos afetados

Alt Linux
Suse
Phpmyadmin