CVE for Wordpress plugin Portable-phpmyadmin

[Anant Shrivastava <anant () anantshri info>]

Hi Team,

Please issue CVE for following issues identified in a wordpress plugin
portable-phpmyadmin


*PHP information Disclosure
*
/pma/phpinfo.php

*Security Bypass *
Allows direct access (with each file level of access differs but you get DB
access with wordpress database username and password)
/pma/db_create.php
/pma/main.php - reveals all the details of database stuff.
/pma/db_datadict.php
/pma/import.php
/pma/querywindow.php
/pma/server_databases.php - Full access to all features including SQL window
/pma/server_export.php


*Disclosure Status.
*
Author (marked in CC) as well as Wordpress Plugin team (marked in CC) is
aware of the issues.
Wordpress plugin team has disabled the plugin download till issues are
resolved.
Author initially responded but stopped responding after a point.

*Timeline*
First contact : 24 July 2013
Last response from Author : 9 Aug 2013
Wordpress plugin team contacted : 11 Sep 2013
Plugin Disabled in plugin repository : 15 Sep 2013
CVE Requested : 21 Oct 2013


-Anant Shrivastava