CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the (1) c_type and possibly (2) file_type parameters.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin
    before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response
    splitting attacks via the (1) c_type and possibly (2) file_type parameters. (CVE-2009-1149)

This update of phpMyAdmin fixes multiple vulnerabilities :

  - CVE-2009-1148: directory traversal

  - CVE-2009-1149: CRLF injection

  - CVE-2009-1150: cross-site scripting

  - CVE-2009-1151: static code injection

ID	Name	Product	Family	Severity
433688	SCA: security update for phpmyadmin/phpmyadmin (GHSA-xrpq-63mp-9vcw)	Tenable Cloud Security	SCA Checks	high
433688	SCA: security update for phpmyadmin/phpmyadmin (GHSA-xrpq-63mp-9vcw)	Tenable Self-Hosted Container Security	SCA Checks	high
40108	openSUSE Security Update : phpMyAdmin (phpMyAdmin-711)	Nessus	SuSE Local Security Checks	high
36081	openSUSE 10 Security Update : phpMyAdmin (phpMyAdmin-6133)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2009-1149

high

Tenable Plugins

high

high

high

high