CVE - CVE-2005-3300

CVE-ID
CVE-2005-3300	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The register_globals emulation layer in grab_globals.php for phpMyAdmin before 2.6.4-pl3 does not perform safety checks on values in the _FILES array for uploaded files, which allows remote attackers to include arbitrary files by using direct requests to library scripts that do not use grab_globals.php, then modifying certain configuration values for the theme.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:15169 URL:http://www.securityfocus.com/bid/15169 BUGTRAQ:20051022 Advisory 16/2005: phpMyAdmin Local File Inclusion Vulnerability URL:http://marc.info/?l=bugtraq&m=113017591414699&w=2 CONFIRM:http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5 DEBIAN:DSA-880 URL:http://www.debian.org/security/2005/dsa-880 FULLDISC:20051022 Advisory 16/2005: phpMyAdmin Local File Inclusion Vulnerability URL:http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0478. GENTOO:GLSA-200510-21 URL:http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml MISC:http://www.hardened-php.net/advisory_162005.73.html SECTRACK:1015091 URL:http://securitytracker.com/id?1015091 SECUNIA:17289 URL:http://secunia.com/advisories/17289/ SECUNIA:17337 URL:http://secunia.com/advisories/17337 SECUNIA:17559 URL:http://secunia.com/advisories/17559 SECUNIA:17607 URL:http://secunia.com/advisories/17607 SUSE:SUSE-SA:2005:066 URL:http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html SUSE:SUSE-SR:2005:026 SUSE:SUSE-SR:2005:028 URL:http://www.novell.com/linux/security/advisories/2005_28_sr.html XF:phpmyadmin-multiple-scripts-file-include(22835) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/22835
Assigning CNA
MITRE Corporation
Date Record Created
20051023	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20051023)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)