OSVDB ID: 8400 Title: phpMyAdmin tbl_copy.php Arbitrary Command Execution |
Info |
|
|
Dates |
||||
|
|
Description |
phpMyAdmin contains a flaw that may allow a remote malicious user to execute arbitrary commands. The issue arises due to the eval() function not properly checking input within tbl_copy.php which can be exploited by sending a specially crafted URL to the page. It is possible that the flaw may allow remote execution of arbitrary commands within the permissions context of the web server's user and group. This could result in a loss of system integrity. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Exploit: Exploit Public Disclosure: OSVDB Verified OSVDB: Web Related |
Solution |
Upgrade to phpMyAdmin version 2.2.0 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: Comment out the eval() function within tbl_copy.php, as there are no call's made to the eval() function at any point within the script. |
Products |
|
References |
|
Credit |
|
agenda-security.co.uk - Agenda Security Services