CVE-2008-4096

libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.5 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:S/C:C/I:C/A:C
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
VendorProductVersion
phpmyadminphpmyadmin
𝑥
≤ 2.11.9
phpmyadminphpmyadmin
2.0
phpmyadminphpmyadmin
2.0.0
phpmyadminphpmyadmin
2.0.1
phpmyadminphpmyadmin
2.0.2
phpmyadminphpmyadmin
2.0.3
phpmyadminphpmyadmin
2.0.4
phpmyadminphpmyadmin
2.0.5
phpmyadminphpmyadmin
2.1
phpmyadminphpmyadmin
2.1.0
phpmyadminphpmyadmin
2.1.1
phpmyadminphpmyadmin
2.1.2
phpmyadminphpmyadmin
2.10.0
phpmyadminphpmyadmin
2.10.0.0
phpmyadminphpmyadmin
2.10.0.1
phpmyadminphpmyadmin
2.10.0.2
phpmyadminphpmyadmin
2.10.1
phpmyadminphpmyadmin
2.10.01
phpmyadminphpmyadmin
2.10.1.0
phpmyadminphpmyadmin
2.10.2
phpmyadminphpmyadmin
2.10.2.0
phpmyadminphpmyadmin
2.10.3
phpmyadminphpmyadmin
2.10.3.0
phpmyadminphpmyadmin
2.10.3rc1:rc1
phpmyadminphpmyadmin
2.11.0
phpmyadminphpmyadmin
2.11.0.0
phpmyadminphpmyadmin
2.11.0beta1:beta1
phpmyadminphpmyadmin
2.11.0rc1:rc1
phpmyadminphpmyadmin
2.11.1
phpmyadminphpmyadmin
2.11.1.0
phpmyadminphpmyadmin
2.11.1.1
phpmyadminphpmyadmin
2.11.1.2
phpmyadminphpmyadmin
2.11.1rc1:rc1
phpmyadminphpmyadmin
2.11.2
phpmyadminphpmyadmin
2.11.2.0
phpmyadminphpmyadmin
2.11.2.1
phpmyadminphpmyadmin
2.11.2.2
phpmyadminphpmyadmin
2.11.3
phpmyadminphpmyadmin
2.11.3.0
phpmyadminphpmyadmin
2.11.3rc1:rc1
phpmyadminphpmyadmin
2.11.4
phpmyadminphpmyadmin
2.11.4.0
phpmyadminphpmyadmin
2.11.4rc1:rc1
phpmyadminphpmyadmin
2.11.5
phpmyadminphpmyadmin
2.11.5.0
phpmyadminphpmyadmin
2.11.5.1
phpmyadminphpmyadmin
2.11.5.2
phpmyadminphpmyadmin
2.11.5rc1:rc1
phpmyadminphpmyadmin
2.11.6
phpmyadminphpmyadmin
2.11.6rc1:rc1
phpmyadminphpmyadmin
2.11.7
phpmyadminphpmyadmin
2.11.8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
phpmyadmin
bullseye
4:5.0.4+dfsg2-2+deb11u1
fixed
bookworm
4:5.2.1+dfsg-1
fixed
sid
4:5.2.1+dfsg-4
fixed
trixie
4:5.2.1+dfsg-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
phpmyadmin
karmic
not-affected
jaunty
not-affected
intrepid
Fixed 4:2.11.8.1-1ubuntu0.1
released
hardy
Fixed 4:2.11.3-1ubuntu1.2
released
gutsy
ignored
feisty
ignored
dapper
ignored
Common Weakness Enumeration
References
http://fd.the-wildcat.de/pma_e36a091q11.php
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
http://osvdb.org/48196
http://secunia.com/advisories/31884
http://secunia.com/advisories/31918
http://secunia.com/advisories/32034
http://secunia.com/advisories/33822
http://security.gentoo.org/glsa/glsa-200903-32.xml
http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/
http://www.debian.org/security/2008/dsa-1641
http://www.mandriva.com/security/advisories?name=MDVSA-2008:202
http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html
http://www.openwall.com/lists/oss-security/2008/09/15/2
http://www.openwall.com/lists/oss-security/2008/09/16/2
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7
http://www.securityfocus.com/bid/31188
http://www.vupen.com/english/advisories/2008/2585
http://www.vupen.com/english/advisories/2008/2619
https://bugzilla.redhat.com/show_bug.cgi?id=462430
https://exchange.xforce.ibmcloud.com/vulnerabilities/45157
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01137.html
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01155.html
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01228.html
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01290.html
http://fd.the-wildcat.de/pma_e36a091q11.php
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
http://osvdb.org/48196
http://secunia.com/advisories/31884
http://secunia.com/advisories/31918
http://secunia.com/advisories/32034
http://secunia.com/advisories/33822
http://security.gentoo.org/glsa/glsa-200903-32.xml
http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/
http://www.debian.org/security/2008/dsa-1641
http://www.mandriva.com/security/advisories?name=MDVSA-2008:202
http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html
http://www.openwall.com/lists/oss-security/2008/09/15/2
http://www.openwall.com/lists/oss-security/2008/09/16/2
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7
http://www.securityfocus.com/bid/31188
http://www.vupen.com/english/advisories/2008/2585
http://www.vupen.com/english/advisories/2008/2619
https://bugzilla.redhat.com/show_bug.cgi?id=462430
https://exchange.xforce.ibmcloud.com/vulnerabilities/45157
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01137.html
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01155.html
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01228.html
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01290.html