CVE-2015-3638

Опубликовано: 21 июл. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to scheduled.php, and making requests to injected scripts, or by injecting PHP into a PHP configuration variable via a PHP variable variable.

Ссылки

http://openwall.com/lists/oss-security/2015/04/25/1
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/05/04/4
Mailing List
Third Party Advisory
http://www.securitytracker.com/id/1032250
Third Party Advisory
VDB Entry
http://openwall.com/lists/oss-security/2015/04/25/1
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/05/04/4
Mailing List
Third Party Advisory
http://www.securitytracker.com/id/1032250
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:phpmybackuppro:phpmybackuppro:*:*:*:*:*:*:*:*

Версия до 2.5 (включая)

EPSS

Процентиль: 81%

0.01612

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-94

Связанные уязвимости

GHSA-fx89-qj4v-348g