PT-2005-1615 · Php · Phpmyadmin

Maksymilian Arciemowicz · Published 2005-02-27 · Updated 2017-07-11 · CVE-2005-0567

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyAdmin version 2.6.1

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by modifying specific parameters to reference a URL on a remote web server that contains the malicious code. The parameters in question are the theme parameter to phpmyadmin.css.php and the cfg[Server][extension] parameter to database interface.lib.php.

Recommendations For phpMyAdmin version 2.6.1, consider restricting access to the phpmyadmin.css.php and database interface.lib.php files until a patch is available. As a temporary workaround, avoid using the theme and cfg[Server][extension] parameters in the affected files to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-0567

Affected Products

Phpmyadmin

References · 11

• http://sourceforge.net/tracker/index.php?func=detail&aid=1149381&group_id=23067&atid=377408 · Patch
• https://security-tracker.debian.org/tracker/CVE-2005-0567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0567 · Security Note
• http://secunia.com/advisories/14382 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-0567 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0567 · Vendor Advisory
• http://phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1 · Vendor Advisory
• http://securityfocus.com/bid/12645 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19465 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0567 · Note
• http://marc.info/?l=bugtraq&m=110929725801154&w=2 · Note