PT-2005-5035 · Phpmyadmin · Phpmyadmin

Lwang · Published 2005-12-19 · Updated 2025-01-16 · CVE-2005-4349

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions phpMyAdmin version 2.7.0

Description A SQL injection issue allows remote authenticated users to execute arbitrary SQL commands via the dbname and checkprivs parameters in the server privileges.php file. However, the vendor and a third party have disputed this issue, stating that the program's main task is to support query execution by authenticated users and no external attack scenario exists without an auto-login configuration.

Recommendations For phpMyAdmin version 2.7.0, consider restricting access to the server privileges.php file and limiting the use of the dbname and checkprivs parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2005-4349

Affected Products

Phpmyadmin

References · 12

• https://security-tracker.debian.org/tracker/CVE-2005-4349 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-4349 · Vendor Advisory
• http://vupen.com/english/advisories/2005/2995 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4349 · Security Note
• http://secunia.com/advisories/18113 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-4349 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4349 · Note
• http://marc.info/?l=bugtraq&m=113486637512821&w=2 · Note
• http://securityfocus.com/archive/1/419832/100/0/threaded · Note
• http://securityreason.com/securityalert/270 · Note
• http://securityfocus.com/archive/1/419829/100/0/threaded · Note
• https://t.me/cvenotify/107697 · Telegram Post