CVE-2008-4096: Input Validation
Description of problem: phpMyAdmin < 2.11.9.1 contains a not yet clearly documented security bug: "Welcome to this security update for phpMyAdmin 2.11.9. Details will follow on http://phpmyadmin.net. Marc Delisle, for the team"
Additional info (http://www.phpmyadmin.net/homepage/downloads.php?relnotes=0): Fixes for 2.11.9.x:
- bug #2031221 [auth] Links to version number on login screen - bug #2032707 [core] PMA does not start if iniset() is disabled - bug #2004915 [bookmarks] Saved queries greater than 1000 chars not displayed - bug #2037381 [export] Export type "replace" does not work - bug #2037375 [export] DROP PROCEDURE needs IF EXISTS - bug #2045512 [export] Numbers in Excel export + [lang] Norwegian UTF-8 original file remerged - bug #2074250 [parser] Undefined variable seenfrom - (2.11.9.1) [security] Code execution vulnerability
Other sources
libraries/databaseinterface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to serverdatabases.php with a sortby parameter containing PHP sequences, which are processed by createfunction.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2008-4096?
CVE-2008-4096 has not been specifically assigned a severity rating, but it is important to address due to potential security risks in older phpMyAdmin versions.
How do I fix CVE-2008-4096?
To fix CVE-2008-4096, upgrade to a version of phpMyAdmin that is later than 2.11.9.
Which versions of phpMyAdmin are affected by CVE-2008-4096?
CVE-2008-4096 affects all phpMyAdmin versions prior to 2.11.9, including but not limited to versions 2.10.3, 2.11.4, and earlier.
What types of vulnerabilities does CVE-2008-4096 represent?
CVE-2008-4096 represents a security bug that may allow unauthorized access or data manipulation within phpMyAdmin.
Is there a known exploit for CVE-2008-4096?
There are no widely reported exploits for CVE-2008-4096, but it is advisable to update the software to mitigate potential risks.