CVE-2005-4349

描述

SQL injection vulnerability in server_privileges.php in phpMyAdmin 2.7.0 allows remote authenticated users to execute arbitrary SQL commands via the (1) dbname and (2) checkprivs parameters. NOTE: the vendor and a third party have disputed this issue, saying that the main task of the program is to support query execution by authenticated users, and no external attack scenario exists without an auto-login configuration. Thus it is likely that this issue will be REJECTED. However, a closely related CSRF issue has been assigned CVE-2005-4450

如何修補 CVE-2005-4349

要修補 CVE-2005-4349,請將受影響套件升級到下列已修補版本。

• —升級至 4:3.2.0-1 或更新版本

CVE-2005-4349 正在被利用嗎?

低 — EPSS 為 1.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 4:3.2.0-1

CVSS 分數

參考連結(1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2005-4349