CVE-2011-2505

Sažetak

libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a "remote variable manipulation vulnerability."

Reference

http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html
http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt
http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php
http://www.openwall.com/lists/oss-security/2011/06/28/2
http://www.osvdb.org/73611
http://www.openwall.com/lists/oss-security/2011/06/28/6
http://www.openwall.com/lists/oss-security/2011/06/28/8
http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/
http://www.openwall.com/lists/oss-security/2011/06/29/11
http://www.exploit-db.com/exploits/17514/
http://secunia.com/advisories/45139
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html
http://secunia.com/advisories/45292
http://www.debian.org/security/2011/dsa-2286
http://secunia.com/advisories/45315
http://securityreason.com/securityalert/8306
http://www.mandriva.com/security/advisories?name=MDVSA-2011:124
http://www.securityfocus.com/archive/1/518804/100/0/threaded
http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=7ebd958b2bf59f96fecd5b3322bdbd0b244a7967

CVSS

Base:	6.4
Impact:	4.9
Exploitability:	10.0

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
NONE	PARTIAL	PARTIAL

CVSS vektor

AV:N/AC:L/Au:N/C:N/I:P/A:P

Zadnje važnije ažuriranje

07-11-2023 - 02:07

Objavljeno

14-07-2011 - 23:55