Detections
Analytics
phpMyAdmin 3.5.x < 3.5.8.2 / 4.0.x < 4.0.4.2 Multiple Vulnerabilities (PMASA-2013-8 - PMASA-2013-15
medium Nessus Plugin ID 69184
Language:
Synopsis
The remote web server hosts a PHP application that is affected by multiple security vulnerabilities.Description
According to its self-identified version number, the phpMyAdmin install hosted on the remote web server is 3.5.x earlier than 3.5.8.2 or 4.0.x earlier than 4.0.4.2. It is, therefore, affected by the following vulnerabilities :- Numerous input validation errors exist that could lead to cross-site scripting attacks related to 'version.json', text to link transformations, schema export, SQL queries, setup, chart display, process list, and the logo link. Note that the link transformation issue, PMASA-2013-13 (CVE-2013-5001), only affects the 4.0.x branch. (CVE-2013-4995, CVE-2013-4996, CVE-2013-4997, CVE-2013-5001, CVE-2013-5002)
- Errors exist that could allow full installation path disclosure via error messages. This information could be used in further attacks. (CVE-2013-4998, CVE-2013-4999, CVE-2013-5000)
- Errors in the files 'schema_export.php' and 'pmd_pdf.php' could allow SQL injection attacks.
(CVE-2013-5003)
Solution
Either upgrade to phpMyAdmin 3.5.8.2, 4.0.4.2 or later, or apply the patches from the referenced links.See Also
http://www.nessus.org/u?3bac023c
http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php
http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php
http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php
http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php
http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php
http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php
http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php
Plugin Details
Severity: Medium
ID: 69184
File Name: phpmyadmin_pmasa_2013_15.nasl
Version: 1.14
Type: remote
Family: CGI abuses
Published: 8/1/2013
Updated: 11/22/2024
Configuration: Enable paranoid mode, Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 4.8
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2013-5003
Vulnerability Information
CPE: cpe:/a:phpmyadmin:phpmyadmin
Required KB Items: www/PHP, www/phpMyAdmin, Settings/ParanoidReport
Exploit Ease: No exploit is required
Patch Publication Date: 7/28/2013
Vulnerability Publication Date: 7/28/2013
Reference Information
CVE: CVE-2013-4995, CVE-2013-4996, CVE-2013-4997, CVE-2013-4998, CVE-2013-4999, CVE-2013-5000, CVE-2013-5001, CVE-2013-5002, CVE-2013-5003
BID: 61510, 61511, 61512, 61513, 61515, 61516, 61919, 61921, 61923