The version of phpMyAdmin installed on the remote host fails to properly protect the global 'import_blacklist' variable, which is used in the 'libraries/grab_globals.lib.php' script to protect global variables in its register_globals emulation layer.  An unauthenticated attacker can exploit this flaw to overwrite arbitrary variables, thereby opening the application up to remote / local file include as well as cross-site scripting attacks.

The remote host is affected by the vulnerability described in GLSA-200512-03 (phpMyAdmin: Multiple vulnerabilities)

    Stefan Esser from Hardened-PHP reported about multiple     vulnerabilities found in phpMyAdmin. The $GLOBALS variable allows     modifying the global variable import_blacklist to open phpMyAdmin to     local and remote file inclusion, depending on your PHP version     (CVE-2005-4079, PMASA-2005-9). Furthermore, it is also possible to     conduct an XSS attack via the $HTTP_HOST variable and a local and     remote file inclusion because the contents of the variable are under     total control of the attacker (CVE-2005-3665, PMASA-2005-8).
  Impact :

    A remote attacker may exploit these vulnerabilities by sending     malicious requests, causing the execution of arbitrary code with the     rights of the user running the web server. The cross-site scripting     issues allow a remote attacker to inject and execute malicious script     code or to steal cookie-based authentication credentials, potentially     allowing unauthorized access to phpMyAdmin.
  Workaround :

    There is no known workaround at this time.

遠端主機上安裝的 phpMyAdmin 版本無法正確保護全域「import_blacklist」變數，在「libraries/grab_globals.lib.php」指令碼中，使用此變數來保護 register_globals 模擬層的全域變數。未經驗證的攻擊者可利用此瑕疵來覆寫任意變數，進而使應用程式容易受到遠端/本機檔案引入以及跨網站指令碼攻擊。

リモートホストにインストールされているphpMyAdminのバージョンは、グローバルな「import_blacklist」変数の保護に失敗します。この変数は、register_globalsエミュレーションレイヤーでグローバル変数を保護するために「libraries/grab_globals.lib.php」スクリプトで使用されます。認証されていない攻撃者が、この欠陥を悪用して、任意の変数を上書きすることで、アプリケーションをリモート/ローカルファイルインクルード攻撃やクロスサイトスクリプティング攻撃に晒す可能性があります。

The remote host is running phpMyAdmin, a web interface for administering MySQL database servers.  This version of phpMyAdmin is vulnerable to a flaw that allows remote attackers to overwrite global variables.  An attacker exploiting this flaw would only need to be able to send an HTTP query to the web server.  Successful exploitation would result in critical variables being overwritten.  This can lead to a partial loss of data integrity.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
22124	phpMyAdmin import_blacklist Variable Overwriting	Nessus	CGI abuses	2006/7/31	2022/4/11	medium
20312	GLSA-200512-03 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2005/12/15	2021/1/6	medium
22124	phpMyAdmin import_blacklist 變數覆寫	Nessus	CGI abuses	2006/7/31	2022/4/11	medium
22124	phpMyAdmin import_blacklist変数の上書き	Nessus	CGI abuses	2006/7/31	2022/4/11	medium
3319	phpMyAdmin < 2.7.0-pl1 Global Variable Overwrite	Nessus Network Monitor	CGI	2005/12/7	2019/3/6	medium

检测

插件搜索

medium

medium

medium

medium

medium