徳丸 浩@ockeghem
好ましくはないけど、実際には有りえて、たとえばphpMyAdminでこういう脆弱性がありました。ただ、やはり好ましくないということで正規表現の利用を当該箇所ではやめました https://blog.tokumaru.org/2013/05/phpMyAdmin3.5.8-script-injection-CVE-2013-3238.html
0152732115.2K
71.3K followersView on X
CVE-2013-3238(phpmyadmin / phpmyadmin)
LOWCVSS 6.0 · MEDIUMImmediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature.
0.0/ 10 priority
Sources & remediation
Other references
- http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104725.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104770.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104936.html
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- phpmyadmin
Affected systems
Vendors
Products
phpmyadmin
12 versions affected across 1 product
Deep dive
Full discourse1 post
CPE platform detail13 entries
13 of 13 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | phpmyadmin | phpmyadmin | 3.5.0.0 | - | - |
| App | phpmyadmin | phpmyadmin | 3.5.1.0 | - | - |
| App | phpmyadmin | phpmyadmin | 3.5.2.0 | - | - |
| App | phpmyadmin | phpmyadmin | 3.5.2.1 | - | - |
| App | phpmyadmin | phpmyadmin | 3.5.2.2 | - | - |
| App | phpmyadmin | phpmyadmin | 3.5.3.0 | - | - |
| App | phpmyadmin | phpmyadmin | 3.5.4 | - | - |
| App | phpmyadmin | phpmyadmin | 3.5.5 | - | - |
| App | phpmyadmin | phpmyadmin | 3.5.6 | - | - |
| App | phpmyadmin | phpmyadmin | 3.5.7 | - | - |
| App | phpmyadmin | phpmyadmin | 3.5.7 | - | - |
| App | phpmyadmin | phpmyadmin | 3.5.8 | - | - |
| App | phpmyadmin | phpmyadmin | 4.0.0 | - | - |