PT-2017-6684 · Phpmybackuppro · Phpmybackuppro

Matthew Daley · Published 2017-07-21 · Updated 2017-07-25 · CVE-2015-3638

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyBackupPro versions prior to 2.5

Description The issue allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to "scheduled.php", and making requests to injected scripts. Additionally, it is possible to inject PHP into a PHP configuration variable via a PHP variable variable.

Recommendations For versions prior to 2.5, as a temporary workaround, consider restricting access to the "scheduled.php" endpoint and avoid using the path, filename, and period parameters until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2015-3638

Affected Products

Phpmybackuppro

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-3638 · Security Note
• http://openwall.com/lists/oss-security/2015/04/25/1 · Patch
• http://securitytracker.com/id/1032250 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3638 · Note
• http://openwall.com/lists/oss-security/2015/05/04/4 · Note