CVE-2011-2643

Sažetak

Directory traversal vulnerability in sql.php in phpMyAdmin 3.4.x before 3.4.3.2, when configuration storage is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a MIME-type transformation parameter.

Reference

http://secunia.com/advisories/45365
http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php
https://bugzilla.redhat.com/show_bug.cgi?id=725382
http://www.securityfocus.com/bid/48874
http://secunia.com/advisories/45515
http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html
http://www.mandriva.com/security/advisories?name=MDVSA-2011:124
https://exchange.xforce.ibmcloud.com/vulnerabilities/68767
http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c

CVSS

Base:	6.8
Impact:	6.4
Exploitability:	8.6

Pristup

Vektor	Složenost	Autentikacija
NETWORK	MEDIUM	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	PARTIAL	PARTIAL

CVSS vektor

AV:N/AC:M/Au:N/C:P/I:P/A:P

Zadnje važnije ažuriranje

07-11-2023 - 02:07

Objavljeno

01-08-2011 - 19:55