phpMyAdmin vulnerable to XML external entity (XXE) injection attack
The `simplexml_load_string` function in the XML import plug-in (`libraries/import/xml.php`) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2011-4107US | medium6.5 | Exploit | ||
The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated use… | ||||
02
references
External citations — patches, advisories, analysis.
- http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.htmlWEB
- http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.htmlWEB
- http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.htmlWEB
- http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txtWEB
- http://seclists.org/fulldisclosure/2011/Nov/21WEB
- http://securityreason.com/securityalert/8533WEB
- http://www.debian.org/security/2012/dsa-2391WEB
- http://www.openwall.com/lists/oss-security/2011/11/03/3WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan