PT-2019-18357 · Php+4 · Phpmyadmin+4

Eddie Tc Chang + 2 · Publicado 2019-01-26 · Atualizado 2024-06-15 · CVE-2019-6798

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.8.5

Description A SQL injection attack can be triggered through the designer feature by using a specially crafted username. This allows for potential exploitation.

Recommendations For versions prior to 4.8.5, update to version 4.8.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the designer feature until a patch is applied. Avoid using specially crafted usernames in the affected feature to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

ALT-PU-2019-1296

CVE-2019-6798

GHSA-F732-FXH6-G4QJ

OPENSUSE-SU-2019:0194-1

OPENSUSE-SU-2019_0194-1

OPENSUSE-SU-2024:11171-1

USN-4639-1

USN-4843-1

Produtos afetados

Alt Linux

Linuxmint

Suse

Ubuntu

Phpmyadmin

Referências · 122

• https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/62b2c918d26cc78d1763945e3d44d1a63294a819 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/1ac863c7573d12012374d5d41e5c7dc5505ea6e1 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/095729d81205f15f40d216d25917017da4c2fff8 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/469934cf7d3bd19a839eb78670590f7511399435 · Nota
• https://github.com/phpmyadmin/composer · Nota
• https://ubuntu.com/security/CVE-2014-9218 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-f732-fxh6-g4qj · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4843-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-6619 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-6609 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000014 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-1000499 · Nota
• https://ubuntu.com/security/CVE-2020-26934 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2006-1804 · Nota