Security Update for phpMyAdmin
Summary
DSA-2975-1: phpmyadmin - security update. Affects phpmyadmin versions < 4:3.4.11.1-2+deb7u1. Fixed in 4:3.4.11.1-2+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a web-based tool used for administering MySQL databases. It provides a user-friendly interface for managing databases, tables, and executing SQL queries. This vulnerability affects phpMyAdmin version 4:3.4.11.1-2+deb7u1 on Debian 7 (wheezy) and version 4:4.2.5-1 on Debian sid (unstable).
Vulnerability Detail
Multiple vulnerabilities have been identified in phpMyAdmin:
- CVE-2013-4995: Authenticated users could inject arbitrary web script or HTML through a crafted SQL query.
- CVE-2013-4996: Cross-site scripting (XSS) was possible via a crafted logo URL in the navigation panel or a crafted entry in the Trusted Proxies list.
- CVE-2013-5002: Authenticated users could inject arbitrary web script or HTML through a crafted pageNumber value in Schema Export.
- CVE-2013-5003: Authenticated users could execute arbitrary SQL commands as the phpMyAdmin control user through the scale parameter PMD PDF export and the pdf_page_number parameter in Schema Export.
- CVE-2014-1879: Authenticated users could inject arbitrary web script or HTML through a crafted file name in the Import function.
These vulnerabilities could allow attackers to execute malicious code, perform SQL injection attacks, or conduct cross-site scripting attacks.
How To Fix
Minimum fixed version
4:3.4.11.1-2+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is essential to apply the recommended package updates to ensure the security of your phpMyAdmin installation.
Conclusion
Multiple vulnerabilities have been identified in phpMyAdmin, which could allow attackers to execute malicious code, perform SQL injection attacks, or conduct cross-site scripting attacks. To ensure the security of your phpMyAdmin installation, it is recommended to upgrade to the latest available version. For further support or assistance, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is a web-based tool used for administering MySQL databases. It provides an intuitive interface for managing databases, tables, and executing SQL queries.
These vulnerabilities could allow attackers to execute malicious code, perform SQL injection attacks, or conduct cross-site scripting attacks, potentially leading to unauthorized access, data manipulation, or information disclosure.
You can check the version of phpMyAdmin by accessing the web interface and navigating to the 'Home' or 'About' section. Alternatively, you can run the command 'phpmyadmin --version' in the terminal.
While specific exploits for these vulnerabilities have not been mentioned, it is crucial to apply the recommended package updates to mitigate the risk of potential attacks.
For further support or assistance regarding vulnerability remediation, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
