Variable Extraction Error Affecting phpmyadmin/phpmyadmin package, versions <4.0.4.1
Threat Intelligence
EPSS
0.14% (52nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-PHPMYADMINPHPMYADMIN-5862956
- published 29 Aug 2023
- disclosed 17 May 2022
- credit Markus Wulftange
Introduced: 17 May 2022
CVE-2013-4729 Open this link in a new tabHow to fix?
Upgrade phpmyadmin/phpmyadmin to version 4.0.4.1 or higher.
Overview
phpmyadmin/phpmyadmin is a web interface for MySQL and MariaDB.
Affected versions of this package are vulnerable to Variable Extraction Error via the import.php function due to not properly restricting the ability of input data to specify a file format. A remote authenticated attacker can modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request.
References
CVSS Scores
version 3.1