Detections
Analytics
CVE-2011-4107
medium
Description
The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
References
https://exchange.xforce.ibmcloud.com/vulnerabilities/71108
http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html
https://github.com/advisories/GHSA-q4mm-89q2-xffg
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4880
https://bugzilla.redhat.com/show_bug.cgi?id=751112
http://www.wooyun.org/bugs/wooyun-2010-03185
http://www.securityfocus.com/bid/50497
http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php
http://www.openwall.com/lists/oss-security/2011/11/03/5
http://www.openwall.com/lists/oss-security/2011/11/03/3
http://www.mandriva.com/security/advisories?name=MDVSA-2011:198
http://www.debian.org/security/2012/dsa-2391
http://securityreason.com/securityalert/8533
http://secunia.com/advisories/46447
http://seclists.org/fulldisclosure/2011/Nov/21
http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt