CERT-In Vulnerability Note
CIVN-2005-0114
phpMyAdmin "import_blacklist" Remote Variables Overwrite Vulnerability
Original Issue Date:December 08, 2005
Severity Rating: HIGH
Systems Affected
Phpmyadmin 2.7.X
Overview
PHPMyAdmin is a powerful open source web-based tool written in PHP for administering MySQL databases. A cross-site-scripting vulnerability has been reported in the PHPMyAdmin which can be exploited by the hacker to gain sensitive system information.
Description
A vulnerability has been reported in the "grab_globals.php" file of the PHPMyAdmin. A variable named "import_blacklist" is not properly protected from being overwritten
It can be exploited by a hacker to execute arbitrary commands/scripts in the users browser.
Solution
Update to version 2.7.0-pl1.
http://www.phpmyadmin.net/home_page/downloads.php
Vendor Information
PHPMyAdmin
http://www.phpmyadmin.net/home_page/index.php
References
Secunia Advisory
http://secunia.com/advisories/17925/
Securityfocus
http://www.securityfocus.com/bid/15761
FrSIRT Advisory
http://www.frsirt.com/english/advisories/2005/2792
Hardened-PHP Project
http://www.hardened-php.net/advisory_252005.110.html
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|