FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2005-0567

This CVE name corresponds to:

Entered	Topic
2005-03-08	phpmyadmin -- arbitrary file include and XSS vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2005-0567 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2005-0567
Phase	Assigned(20050227)

Description

Multiple PHP remote file inclusion vulnerabilities in phpMyAdmin 2.6.1 allow remote attackers to execute arbitrary PHP code by modifying the (1) theme parameter to phpmyadmin.css.php or (2) cfg[Server][extension] parameter to database_interface.lib.php to reference a URL on a remote web server that contains the code.

References

Source	Reference
BUGTRAQ	20050224 [SECURITYREASON.COM] phpMyAdmin 2.6.1 Remote file inclusion and XSS cXIb8O3.4
CONFIRM	http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1
CONFIRM	http://sourceforge.net/tracker/index.php?func=detail&aid=1149381&group_id=23067&atid=377408
BID	12645
SECUNIA	14382
XF	phpmyadmin-file-include(19465)