PT-2017-6684 · Phpmybackuppro · Phpmybackuppro

Matthew Daley · Publicado 2017-07-21 · Atualizado 2017-07-25 · CVE-2015-3638

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyBackupPro versions prior to 2.5

Description The issue allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to "scheduled.php", and making requests to injected scripts. Additionally, it is possible to inject PHP into a PHP configuration variable via a PHP variable variable.

Recommendations For versions prior to 2.5, as a temporary workaround, consider restricting access to the "scheduled.php" endpoint and avoid using the path, filename, and period parameters until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2015-3638

Produtos afetados

Phpmybackuppro

Referências · 5

• http://securitytracker.com/id/1032250 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3638 · Nota
• http://openwall.com/lists/oss-security/2015/05/04/4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3638 · Nota de Segurança
• http://openwall.com/lists/oss-security/2015/04/25/1 · Correção