CVE-2011-2643

critical

Description

Directory traversal vulnerability in sql.php in phpMyAdmin 3.4.x before 3.4.3.2, when configuration storage is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a MIME-type transformation parameter.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/68767

https://bugzilla.redhat.com/show_bug.cgi?id=725382

http://www.securityfocus.com/bid/48874

http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php

http://www.mandriva.com/security/advisories?name=MDVSA-2011:124

http://secunia.com/advisories/45515

http://secunia.com/advisories/45365

http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c

http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html

http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html

Details

Source: Mitre, NVD

Published: 2011-08-01

Updated: 2023-11-07

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical