Remote Code Execution Vulnerability in phpLDAPadmin: CVE-2005-2793
Summary
DEBIAN-CVE-2005-2793: PHP remote file inclusion vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to execute arbitrary PHP code via the custom_welcome_page parameter. Affects phpldapadmin versions < 0.9.6c-7. Fixed in 0.9.6c-7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpLDAPadmin is a web-based application written in PHP that provides a user-friendly interface for managing LDAP directories. It allows administrators to perform various tasks such as adding, deleting, and modifying entries in the LDAP directory. The application is widely used due to its ease of use and powerful features. However, it has been found to contain a remote file inclusion vulnerability that can be exploited by attackers to execute arbitrary PHP code.
Vulnerability Detail
The vulnerability, identified as CVE-2005-2793, arises from a flaw in the welcome.php file of phpLDAPadmin versions 0.9.6 and 0.9.7. It allows remote attackers to include arbitrary files via the 'custom_welcome_page' parameter. This can lead to unauthorized execution of PHP code on the server, potentially compromising the entire system. The vulnerability is classified as medium urgency, indicating a moderate risk to users of the affected versions.
How To Fix
Minimum fixed version
0.9.6c-7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpldapadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the custom welcome page feature in phpLDAPadmin to mitigate the risk of exploitation until the package is updated.
Conclusion
In summary, CVE-2005-2793 is a medium urgency vulnerability in phpLDAPadmin that allows remote code execution through improper handling of the custom_welcome_page parameter. Users are strongly advised to update to version 0.9.6c-7 or later to mitigate this risk. Temporary workarounds are available, but updating is the best long-term solution.
See every vulnerability recorded for phpldapadmin →
FAQ
CVE-2005-2793 is a vulnerability in phpLDAPadmin that allows remote code execution through a flaw in the welcome.php file.
The vulnerability affects phpLDAPadmin versions 0.9.6 and 0.9.7.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability can lead to unauthorized access and control over the server, potentially compromising sensitive data.
Yes, you can disable the custom welcome page feature as a temporary workaround until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpldapadmin.
