PT-2013-4244 · Phpmyadmin · Phpmyadmin

Waraxe · Published 2013-04-26 · Updated 2024-06-15 · CVE-2013-3238

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 3.5.x through 3.5.7 phpMyAdmin versions 4.x through 4.0.0-rc2

Description The issue allows remote authenticated users to execute arbitrary code via a /ex00 sequence. This sequence is not properly handled before making a preg replace function call within the "Replace table prefix" feature.

Recommendations For phpMyAdmin versions 3.5.x through 3.5.7, update to version 3.5.8 or later. For phpMyAdmin versions 4.x through 4.0.0-rc2, update to version 4.0.0-rc3 or later.

Exploit

Fix

Related Identifiers

CVE-2013-3238

OPENSUSE-SU-2024:10054-1

Affected Products

Phpmyadmin

References · 141

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmyadmin_preg_replace.rb · Exploit
• 🔥 http://exploit-db.com/exploits/25136 · Exploit
• 🔥 https://exploit-db.com/exploits/25136 · Exploit
• 🔥 https://exploit-db.com/exploits/25003 · Exploit
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104936.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3238 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2013:160 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104725.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10054-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104770.html · Vendor Advisory
• https://github.com/phpmyadmin/phpmyadmin/commit/ffa720d90a79c1f33cf4c5a33403d09a67b42a66 · Note
• https://github.com/phpmyadmin/phpmyadmin/commit/dedd542cdaf1606ca9aa3f6f8f8adb078d8ad549 · Note
• https://suse.com/security/cve/CVE-2016-9859 · Note
• https://suse.com/security/cve/CVE-2016-9865 · Note