Lucene search

K
freebsdFreeBSD0FF0E9A6-4EE0-11D9-A9E7-0001020EED82
HistoryDec 13, 2004 - 12:00 a.m.

phpmyadmin -- command execution vulnerability

2004-12-1300:00:00
vuxml.freebsd.org
50

CVSS2

10

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.018

Percentile

88.1%

A phpMyAdmin security announcement reports:

Command execution: since phpMyAdmin 2.6.0-pl2, on a
system where external MIME-based transformations are
activated, an attacker can put into MySQL data an
offensive value that starts a shell command when
browsed.

Enabling PHP safe mode on the server can be used as
a workaround for this vulnerability.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchphpmyadmin= 2.6.0.2UNKNOWN
FreeBSDanynoarchphpmyadmin< 2.6.1.r1UNKNOWN

CVSS2

10

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.018

Percentile

88.1%