CVE-2010-3055

Опубликовано: 24 авг. 2010

Источник: nvd

CVSS2: 7.5

EPSS Низкий

Описание

The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.

Ссылки

http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=30c83acddb58d3bbf940b5f9ec28abf5b235f4d2
http://secunia.com/advisories/41058
Vendor Advisory
http://secunia.com/advisories/41185
Vendor Advisory
http://sourceforge.net/tracker/?func=detail&aid=3045132&group_id=23067&atid=377408
Exploit
http://www.debian.org/security/2010/dsa-2097
http://www.mandriva.com/security/advisories?name=MDVSA-2010:163
http://www.phpmyadmin.net/home_page/security/PMASA-2010-4.php
Patch
Vendor Advisory
http://www.securityfocus.com/bid/42591
Patch
http://www.vupen.com/english/advisories/2010/2223
Vendor Advisory
http://www.vupen.com/english/advisories/2010/2231
Vendor Advisory
http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=30c83acddb58d3bbf940b5f9ec28abf5b235f4d2
http://secunia.com/advisories/41058
Vendor Advisory
http://secunia.com/advisories/41185
Vendor Advisory
http://sourceforge.net/tracker/?func=detail&aid=3045132&group_id=23067&atid=377408
Exploit
http://www.debian.org/security/2010/dsa-2097
http://www.mandriva.com/security/advisories?name=MDVSA-2010:163
http://www.phpmyadmin.net/home_page/security/PMASA-2010-4.php
Patch
Vendor Advisory
http://www.securityfocus.com/bid/42591
Patch
http://www.vupen.com/english/advisories/2010/2223
Vendor Advisory
http://www.vupen.com/english/advisories/2010/2231
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.1:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8.0:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.6:*:*:*:*:*:*:*

cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 80%

0.01469

Низкий

7.5 High

CVSS2

Дефекты

CWE-264

Связанные уязвимости

CVE-2010-3055

ubuntu

почти 15 лет назад

CVE-2010-3055

debian

почти 15 лет назад

The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2 ...

GHSA-6442-8w69-mgwm

github

около 3 лет назад

EPSS

Процентиль: 80%

0.01469

Низкий

7.5 High

CVSS2

Дефекты

CWE-264