National Cyber-Alert System

Vulnerability Summary for CVE-2008-4096

Overview

libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: MLIST

Name: [phpmyadmin-news] 20080915 phpMyAdmin 2.11.9.1 is released

Type: Patch Information

Hyperlink:http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html

External Source: FEDORA

Name: FEDORA-2008-8370

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01290.html

External Source: FEDORA

Name: FEDORA-2008-8335

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01228.html

External Source: FEDORA

Name: FEDORA-2008-8286

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01155.html

External Source: FEDORA

Name: FEDORA-2008-8269

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01137.html

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=462430

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=462430

External Source: XF

Name: phpmyadmin-serverdatabases-code-execution(45157)

Hyperlink:http://xforce.iss.net/xforce/xfdb/45157

External Source: VUPEN

Name: ADV-2008-2619

Hyperlink:http://www.vupen.com/english/advisories/2008/2619

External Source: BID

Name: 31188

Hyperlink:http://www.securityfocus.com/bid/31188

External Source: CONFIRM

Name: http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7

Hyperlink:http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7

External Source: MLIST

Name: [oss-security] 20080915 Re: phpMyAdmin code execution (CVE request)

Hyperlink:http://www.openwall.com/lists/oss-security/2008/09/16/2

External Source: MLIST

Name: [oss-security] 20080915 phpMyAdmin code execution (CVE request)

Hyperlink:http://www.openwall.com/lists/oss-security/2008/09/15/2

External Source: MANDRIVA

Name: MDVSA-2008:202

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:202

External Source: VUPEN

Name: ADV-2008-2585

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2008/2585

External Source: DEBIAN

Name: DSA-1641

Hyperlink:http://www.debian.org/security/2008/dsa-1641

External Source: CONFIRM

Name: http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/

Hyperlink:http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/

External Source: GENTOO

Name: GLSA-200903-32

Hyperlink:http://security.gentoo.org/glsa/glsa-200903-32.xml

External Source: SECUNIA

Name: 33822

Hyperlink:http://secunia.com/advisories/33822

External Source: SECUNIA

Name: 32034

Hyperlink:http://secunia.com/advisories/32034

External Source: SECUNIA

Name: 31918

Hyperlink:http://secunia.com/advisories/31918

External Source: SECUNIA

Name: 31884

Type: Advisory

Hyperlink:http://secunia.com/advisories/31884

External Source: OSVDB

Name: 48196

Hyperlink:http://osvdb.org/48196

External Source: SUSE

Name: SUSE-SR:2009:003

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html

External Source: MISC

Name: http://fd.the-wildcat.de/pma_e36a091q11.php

Hyperlink:http://fd.the-wildcat.de/pma_e36a091q11.php