Directory Traversal Vulnerability in phpLDAPadmin
Summary
CVE-2009-4427: Directory traversal vulnerability in cmd.php in phpLDAPadmin 1.1.0.5 allows remote attackers to include and execute arbitrary local files via a .. Affects phpldapadmin versions < 1.1.0.7-1.1. Fixed in 1.1.0.7-1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
phpLDAPadmin is a web-based LDAP client that allows users to manage LDAP servers. It provides a graphical interface for performing various LDAP operations such as browsing, searching, and modifying entries. The vulnerability in phpLDAPadmin version 1.1.0.5 allows remote attackers to include and execute arbitrary local files by exploiting a directory traversal vulnerability in the cmd.php script. This vulnerability can lead to unauthorized access to sensitive files and potential remote code execution.
Vulnerability Detail
The directory traversal vulnerability in cmd.php allows an attacker to manipulate the 'cmd' parameter by appending '../' sequences to traverse directories and include arbitrary local files. By exploiting this vulnerability, an attacker can execute arbitrary code or access sensitive information on the server. This can result in a complete compromise of the affected system and potential unauthorized access to sensitive data.
How To Fix
Minimum fixed version
1.1.0.7-1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpldapadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to restrict access to the vulnerable cmd.php script. This can be achieved by implementing access control rules at the web server level or by removing the script if it is not required for the application's functionality. However, applying the fix by upgrading to the latest version is strongly recommended.
Conclusion
The directory traversal vulnerability in phpLDAPadmin version 1.1.0.5 can allow remote attackers to include and execute arbitrary local files. It is crucial to upgrade to the latest version (1.1.0.7-1.1 or later) to mitigate this vulnerability. Restricting access to the vulnerable script or removing it temporarily can serve as a workaround until the upgrade is performed. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpldapadmin →
FAQ
phpLDAPadmin is a web-based LDAP client used for managing LDAP servers. It provides a user-friendly interface for performing LDAP operations.
A directory traversal vulnerability allows an attacker to access files outside of the intended directory by manipulating input parameters or file paths.
This vulnerability can lead to unauthorized access to sensitive files, potential remote code execution, and compromise of the affected system.
To fix this vulnerability, it is recommended to upgrade to phpLDAPadmin version 1.1.0.7-1.1 or later. Ensure to follow the official upgrade instructions provided by the phpLDAPadmin project.
A temporary workaround is to restrict access to the vulnerable cmd.php script or remove it if not required. However, upgrading to the latest version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for phpldapadmin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
