ID de Prueba:	1.3.6.1.4.1.25623.1.0.900130
Categoría:	Web application abuses
Título:	phpMyAdmin 'server_databases.php' RCE Vulnerability
Resumen:	phpMyAdmin is prone to a remote command execution (RCE) vulnerability.
Descripción:	Summary: phpMyAdmin is prone to a remote command execution (RCE) vulnerability. Vulnerability Insight: This issue is caused by, sort_by parameter in server_databases.php which is not properly sanitised before being used. Vulnerability Impact: Successful exploitation allows execution of arbitrary commands, and possibly compromise the affected application. Affected Software/OS: phpMyAdmin versions prior to 2.11.9.1. Solution: Upgrade to phpMyAdmin 2.11.9.1 or later. CVSS Score: 8.5 CVSS Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2008-4096 BugTraq ID: 31188 http://www.securityfocus.com/bid/31188 Debian Security Information: DSA-1641 (Google Search) http://www.debian.org/security/2008/dsa-1641 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01137.html https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01155.html https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01228.html https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01290.html http://security.gentoo.org/glsa/glsa-200903-32.xml http://www.mandriva.com/security/advisories?name=MDVSA-2008:202 http://fd.the-wildcat.de/pma_e36a091q11.php http://www.openwall.com/lists/oss-security/2008/09/16/2 http://www.openwall.com/lists/oss-security/2008/09/15/2 http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html http://osvdb.org/48196 http://secunia.com/advisories/31884 http://secunia.com/advisories/31918 http://secunia.com/advisories/32034 http://secunia.com/advisories/33822 SuSE Security Announcement: SUSE-SR:2009:003 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html http://www.vupen.com/english/advisories/2008/2585 http://www.vupen.com/english/advisories/2008/2619 XForce ISS Database: phpmyadmin-serverdatabases-code-execution(45157) https://exchange.xforce.ibmcloud.com/vulnerabilities/45157
Copyright	Copyright (C) 2008 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.