According to its self-identified version number, the phpMyAdmin 3.5.x / 4.0.0 install hosted on the remote web server is earlier than 3.5.8.1 / 4.0.0-rc3 and is, therefore, affected by multiple vulnerabilities:

  - The 'preg_replace' fails to properly sanitize     arguments, which can be used to for arbitrary code     execution. (CVE-2013-3238)

  - A security weakness exists in the way that locally saved     databases are handled.  It is possible that the     'filename_template' parameter can be used to create a     file with double extensions. (CVE-2013-3239)

  - A flaw exists where the 'what' parameter was not     correctly validated, allowing for a local file     inclusion. This flaw reportedly affects phpMyAdmin 4.x     only. (CVE-2013-3240)

  - A flaw exists in the 'export.php' script that allows     overwrite of global variables, leading to an     unauthorized access vulnerability. This flaw reportedly     affects phpMyAdmin 4.x only. (CVE-2013-3241)

Detections

Analytics

phpMyAdmin 3.5.x < 3.5.8.1 / 4.x < 4.0.0-rc3 Multiple Vulnerabilities (PMASA-2013-2 - PMASA-2013-5

medium Nessus Plugin ID 66295

Version 1.10