Full Disclosure mailing list archives
Vulnerabilities in phpMyAdmin
From: "MustLive" <mustlive () websecurity com ua>
Date: Mon, 28 Feb 2011 21:09:49 +0200
Hello list! I want to warn you about Brute Force and Full path disclosure vulnerabilities in phpMyAdmin. CVE id: CVE-2011-0986. WASC ids: WASC-11, WASC-13. CWE ids: CWE-661, CWE-200. ------------------------- Affected products: ------------------------- Vulnerable are phpMyAdmin 3.3.9 and previous versions and phpMyAdmin 2.11.11.1 and previous versions. All applications (such as XAMPP), which are using phpMyAdmin, are also vulnerable. Full path disclosure vulnerabilities were fixed by developers in versions 3.3.9.1 and 2.11.11.2. ---------- Details: ---------- Brute Force (WASC-11): http://site/phpmyadmin/ In login form there is no protection from Brute Force attacks. Full path disclosure (WASC-13): http://site/phpmyadmin/readme.php (if there is no README file in folder phpmyadmin) http://site/phpmyadmin/changelog.php (if there is no ChangeLog file in folder phpmyadmin) http://site/phpmyadmin/license.php (if there is no LICENSE file in folder phpmyadmin) ------------ Timeline: ------------ 2011.01.25 - announced at my site. 2011.01.26 - informed developers. 2011.01.31 - received answer from developers. 2011-02-01 - I gave developers additional argumentations and recommendations about fixing Brute Force and Full path disclosure holes and privately informed about all those Fingerprinting (WASC-45) holes in phpMyAdmin. 2011-02-08 - developers fixed FPD holes (http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php). 2011.02.28 - disclosed at my site. I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/4872/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Vulnerabilities in phpMyAdmin MustLive (Feb 28)