CVE-2011-2506

Sažetak

setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.

Reference

http://www.osvdb.org/73612
http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php
http://www.openwall.com/lists/oss-security/2011/06/28/2
http://www.openwall.com/lists/oss-security/2011/06/28/8
http://secunia.com/advisories/45139
http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt
http://www.openwall.com/lists/oss-security/2011/06/29/11
http://www.openwall.com/lists/oss-security/2011/06/28/6
http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html
http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/
http://www.exploit-db.com/exploits/17514/
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html
http://secunia.com/advisories/45292
http://www.debian.org/security/2011/dsa-2286
http://secunia.com/advisories/45315
http://securityreason.com/securityalert/8306
http://www.mandriva.com/security/advisories?name=MDVSA-2011:124
http://www.securityfocus.com/archive/1/518804/100/0/threaded
http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=0fbedaf5fd7a771d0885c6b7385d934fc90d0d7f

CVSS

Base:	7.5
Impact:	6.4
Exploitability:	10.0

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	PARTIAL	PARTIAL

CVSS vektor

AV:N/AC:L/Au:N/C:P/I:P/A:P

Zadnje važnije ažuriranje

07-11-2023 - 02:07

Objavljeno

14-07-2011 - 23:55