CERT-MU :Advisories

Home | Search | FAQ | Site Map | Contact Us

|| Hotline : 800 2378 || To contact CERT-MU send e-mail on --> info[at]cert-mu.gov.mu || To report incident e-mail on --> incident[at]cert-mu.gov.mu || To report Vulnerabilities send e-mail on --> Vulnerability[at]cert-mu.gov.mu ||

Charter & Mission

CERT-MU Services

Constituency

Authority

Incident Reporting

Vulnerability Reporting

Incident Statistics Forms

Vol. 2, Feb 2012

Vol. 1, Oct 2011

World CERTs

Security Sites

Security Tools

Antivirus Resources

Email Abuse

Network Abuse

Anti-Spam Initiative

Cyber Security Portal

Safer Internet Day

Computer Security Day

National Computer Board

Authorized to use CERT(TM) - CERT is a mark owned by Carnegie Mellon University

CERT-MU AD-2010-3

Multiple Vulnerabilities in phpMyAdmin

Original issue date: 8 February, 2010

Overview

Multiple vulnerabilities have been reported in phpMyAdmin versions prior to 2.11.10, which could allow a remote attacker to bypass certain security restrictions and conduct cross-site request forgery attacks.

Description

Temporary Directory Permission Vulnerability

This vulnerability is caused due to libraries /File.class.php in phpMyAdmin creates a temporary directory with 0777 permissions and uses predictable filenames for temporary files, which could be exploited to modify files.

Temporary File Predictible Filename Vulnerability

This vulnerability is caused due to libraries /File.class.php in phpMyAdmin uses predictable filenames for temporary files, which could be exploited to manipulate certain files.

Multiple Parameter CSRF Vulnerability

This vulnerability is caused due to the "/scripts/setup.php" script using the "unserialize()" function on the values of the (1) configuration and (2) v[0] parameters, which might allow remote attackers to conduct cross-site request forgery (CSRF) attacks.

Software Affected