Actu
Vigil@nce: phpMyAdmin, several vulnerabilities
April 2009 by Vigil@nce
Several phpMyAdmin vulnerabilities can be used by an attacker to
read or alter a file, or to create a Cross Site Scripting.
– Gravity: 2/4
– Consequences: client access/rights, data reading, data
creation/edition
– Provenance: document
– Means of attack: no proof of concept, no attack
– Ability of attacker: expert (4/4)
– Confidence: confirmed by the editor (5/5)
– Diffusion of the vulnerable configuration: high (3/3)
– Number of vulnerabilities in this bulletin: 3
– Creation date: 25/03/2009
IMPACTED PRODUCTS
– Fedora
– Unix - plateform
DESCRIPTION OF THE VULNERABILITY
The phpMyAdmin server is used to administer a MySQL database via a
web browser. It is impacted by three vulnerabilities.
An attacker can use the "BLOB streaming" feature in order to read
a file or to inject HTTP headers. [grav:2/4; BID-34253,
CVE-2009-1148, CVE-2009-1149, PMASA-2009-1]
An attacker can use cookies of the export feature to create a
Cross Site Scripting. [grav:2/4; BID-34251, CVE-2009-1150,
PMASA-2009-2]
An attacker can use a POST query to inject data in a configuration
file. [grav:2/4; BID-34236, CVE-2009-1151, PMASA-2009-3]
CHARACTERISTICS
– Identifiers: BID-34236, BID-34251, BID-34253, CVE-2009-1148,
CVE-2009-1149, CVE-2009-1150, CVE-2009-1151, FEDORA-2009-2984,
FEDORA-2009-3006, PMASA-2009-1, PMASA-2009-2, PMASA-2009-3,
VIGILANCE-VUL-8558
– Url: http://vigilance.fr/vulnerability/phpMyAdmin-several-vulnerabilities-8558
