PT-2018-11267 · Phpmyadmin+4 · Phpmyadmin+4

William Desportes · Publicado 2018-06-21 · Atualizado 2024-06-15 · CVE-2018-12581

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.8.2

Description A Cross-Site Scripting issue has been found where an attacker can use a crafted database name to trigger an attack when that database is referenced from the Designer feature. The issue is related to the js/designer/move.js file.

Recommendations For versions prior to 4.8.2, update to version 4.8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Designer feature until the update is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2018-1925

CVE-2018-12581

GHSA-VXJ6-PM6R-23HQ

MGASA-2018-0304

OPENSUSE-SU-2018_1806-1

OPENSUSE-SU-2024:11171-1

USN-4843-1

Produtos afetados

Alt Linux

Linuxmint

Suse

Ubuntu

Phpmyadmin

Referências · 123

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb · Exploit
• 🔥 https://github.com/0x00-0x00/CVE-2018-12613 · Exploit
• 🔥 https://github.com/ivanitlearning/CVE-2018-12613 · Exploit
• https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/62b2c918d26cc78d1763945e3d44d1a63294a819 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/1ac863c7573d12012374d5d41e5c7dc5505ea6e1 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/095729d81205f15f40d216d25917017da4c2fff8 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/6943fff87324bd54c3a37a5160a5fb77498c355e · Nota
• https://ubuntu.com/security/CVE-2014-9218 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4843-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-6619 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-6609 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000014 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-1000499 · Nota
• https://web.archive.org/web/20210413204012/http://securitytracker.com/id/1041187 · Nota