PT-2001-2205 · Php · Phpmyadmin

Published 2001-07-31 · Updated 2009-04-03 · CVE-2001-1060

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 2.2.0rc3 and earlier

Description The issue allows remote attackers to execute arbitrary commands by inserting them into specific arguments in certain PHP files. This can be done by inserting commands into the strCopyTableOK argument in tbl copy.php or the strRenameTableOK argument in tbl rename.php.

Recommendations For phpMyAdmin versions 2.2.0rc3 and earlier, consider upgrading to a version that is not affected by this issue. As a temporary workaround, restrict access to the tbl copy.php and tbl rename.php files to minimize the risk of exploitation. Avoid using the strCopyTableOK and strRenameTableOK arguments in these files until the issue is resolved.

Fix

Related Identifiers

CVE-2001-1060

Affected Products

Phpmyadmin

References · 5

• http://securityfocus.com/bid/3121 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2001-1060 · Security Note
• http://freshmeat.net/redir/phpmyadmin/8001/url_changelog · Note
• http://securityfocus.com/archive/1/200596 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1060 · Note