Detections
Analytics

phpMyAdmin 2.11.x / 3.3.x < 2.11.11.3 / 3.3.9.2 SQL Query Bookmarks Arbitrary SQL Query Execution (PMASA-2011-02)

medium Nessus Plugin ID 59244

Language:

Synopsis

The remote web server hosts a PHP application that could be abused to execute SQL queries.

Description

According to its self-identified version number, the phpMyAdmin install hosted on the remote web server allows creation of bookmarked SQL queries which could be unintentionally executed by other users.

Note that successful exploitation of this vulnerability requires that phpMyAdmin configuration storage is set up and enabled and that the application's bookmarks feature is enabled.

Solution

Either upgrade to phpMyAdmin 2.11.11.3 / 3.3.9.2 or later, or apply the patch from the referenced link

See Also

http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php

Plugin Details

Severity: Medium

ID: 59244

File Name: phpmyadmin_pmasa_2011_2.nasl

Version: 1.9

Type: remote

Family: CGI abuses

Published: 5/23/2012

Updated: 4/11/2022

Configuration: Enable paranoid mode, Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2011-0987

Vulnerability Information

CPE: cpe:/a:phpmyadmin:phpmyadmin

Required KB Items: www/PHP, Settings/ParanoidReport, www/phpMyAdmin

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Patch Publication Date: 2/11/2011

Vulnerability Publication Date: 2/11/2011

Reference Information

CVE: CVE-2011-0987

BID: 46359