CVE-2023-40619: Critical severity phppgadmin vulnerability
phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-40619?
CVE-2023-40619 is a vulnerability in phpPgAdmin 7.14.4 and earlier that allows for the deserialization of untrusted data, potentially leading to remote code execution.
How does CVE-2023-40619 exploit work?
CVE-2023-40619 exploits the vulnerability by passing user-controlled data directly to the PHP 'unserialize()' function, potentially allowing an attacker to execute arbitrary code.
What is the severity of CVE-2023-40619?
The severity of CVE-2023-40619 is critical, with a severity value of 9.8.
Which versions of phpPgAdmin are affected by CVE-2023-40619?
phpPgAdmin versions 7.14.4 and earlier are affected by CVE-2023-40619.
How can I mitigate the vulnerability in phpPgAdmin?
To mitigate the vulnerability in phpPgAdmin, it is recommended to update to a version that includes a fix for CVE-2023-40619 and to follow best practices for secure development and deployment.