The remote host is affected by the vulnerability described in GLSA-200512-03 (phpMyAdmin: Multiple vulnerabilities)

    Stefan Esser from Hardened-PHP reported about multiple     vulnerabilities found in phpMyAdmin. The $GLOBALS variable allows     modifying the global variable import_blacklist to open phpMyAdmin to     local and remote file inclusion, depending on your PHP version     (CVE-2005-4079, PMASA-2005-9). Furthermore, it is also possible to     conduct an XSS attack via the $HTTP_HOST variable and a local and     remote file inclusion because the contents of the variable are under     total control of the attacker (CVE-2005-3665, PMASA-2005-8).
  Impact :

    A remote attacker may exploit these vulnerabilities by sending     malicious requests, causing the execution of arbitrary code with the     rights of the user running the web server. The cross-site scripting     issues allow a remote attacker to inject and execute malicious script     code or to steal cookie-based authentication credentials, potentially     allowing unauthorized access to phpMyAdmin.
  Workaround :

    There is no known workaround at this time.

The version of phpMyAdmin installed on the remote host fails to properly protect the global 'import_blacklist' variable, which is used in the 'libraries/grab_globals.lib.php' script to protect global variables in its register_globals emulation layer.  An unauthenticated attacker can exploit this flaw to overwrite arbitrary variables, thereby opening the application up to remote / local file include as well as cross-site scripting attacks.

リモートホストにインストールされているphpMyAdminのバージョンは、グローバルな「import_blacklist」変数の保護に失敗します。この変数は、register_globalsエミュレーションレイヤーでグローバル変数を保護するために「libraries/grab_globals.lib.php」スクリプトで使用されます。認証されていない攻撃者が、この欠陥を悪用して、任意の変数を上書きすることで、アプリケーションをリモート/ローカルファイルインクルード攻撃やクロスサイトスクリプティング攻撃に晒す可能性があります。

遠端主機上安裝的 phpMyAdmin 版本無法正確保護全域「import_blacklist」變數，在「libraries/grab_globals.lib.php」指令碼中，使用此變數來保護 register_globals 模擬層的全域變數。未經驗證的攻擊者可利用此瑕疵來覆寫任意變數，進而使應用程式容易受到遠端/本機檔案引入以及跨網站指令碼攻擊。

The remote host is running phpMyAdmin, a web interface for administering MySQL database servers.  This version of phpMyAdmin is vulnerable to a flaw that allows remote attackers to overwrite global variables.  An attacker exploiting this flaw would only need to be able to send an HTTP query to the web server.  Successful exploitation would result in critical variables being overwritten.  This can lead to a partial loss of data integrity.

ID	名稱	產品	系列	已發布	已更新	嚴重性
20312	GLSA-200512-03 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2005/12/15	2021/1/6	medium
22124	phpMyAdmin import_blacklist Variable Overwriting	Nessus	CGI abuses	2006/7/31	2022/4/11	medium
22124	phpMyAdmin import_blacklist変数の上書き	Nessus	CGI abuses	2006/7/31	2022/4/11	medium
22124	phpMyAdmin import_blacklist 變數覆寫	Nessus	CGI abuses	2006/7/31	2022/4/11	medium
3319	phpMyAdmin < 2.7.0-pl1 Global Variable Overwrite	Nessus Network Monitor	CGI	2005/12/7	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium