CVE-2013-3239: Code Injection
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-3239?
CVE-2013-3239 is considered a critical vulnerability due to its ability to allow remote authenticated users to execute arbitrary code.
How do I fix CVE-2013-3239?
To fix CVE-2013-3239, upgrade to phpMyAdmin version 3.5.8.1 or later.
What versions of phpMyAdmin are affected by CVE-2013-3239?
CVE-2013-3239 affects phpMyAdmin versions 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3.
Can CVE-2013-3239 be exploited without authentication?
No, CVE-2013-3239 can only be exploited by remote authenticated users.
What impact does CVE-2013-3239 have on Apache servers?
CVE-2013-3239 allows for the execution of arbitrary code, which could compromise the security of Apache servers hosting the affected phpMyAdmin versions.