Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE for Wordpress plugin Portable-phpmyadmin
From: Anant Shrivastava <anant () anantshri info>
Date: Tue, 22 Oct 2013 08:15:34 +0530

Old download URL http://wordpress.org/plugins/portable-phpmyadmin/
As already informed the download link will not work as it is disabled by
word press plugin team

Svn repository http://plugins.svn.wordpress.org/portable-phpmyadmin/

Effected version 1.4.1

-Anant
 -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/21/2013 09:08 AM, Anant Shrivastava wrote:
Hi Team,

Please issue CVE for following issues identified in a wordpress
plugin portable-phpmyadmin


*PHP information Disclosure * /pma/phpinfo.php

*Security Bypass * Allows direct access (with each file level of
access differs but you get DB access with wordpress database
username and password) /pma/db_create.php /pma/main.php - reveals
all the details of database stuff. /pma/db_datadict.php
/pma/import.php /pma/querywindow.php /pma/server_databases.php -
Full access to all features including SQL window
/pma/server_export.php


*Disclosure Status. * Author (marked in CC) as well as Wordpress
Plugin team (marked in CC) is aware of the issues. Wordpress plugin
team has disabled the plugin download till issues are resolved.
Author initially responded but stopped responding after a point.

*Timeline* First contact : 24 July 2013 Last response from Author :
9 Aug 2013 Wordpress plugin team contacted : 11 Sep 2013 Plugin
Disabled in plugin repository : 15 Sep 2013 CVE Requested : 21 Oct
2013


-Anant Shrivastava


Can you post the url/download link for this app?

- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)

iQIcBAEBAgAGBQJSZYssAAoJEBYNRVNeJnmTPJgQANtKvnRl4scnR98T1mye1qwB
14IqpjNgQhYnhajrEUK+heJhudbIN4CS4Mwu01mVIoUdj2GKBP0iRgdc9vBJCDSY
FbVfGjshuQvCKMDd1KGRcKPJG0fxnDk+CKk0HDP/pwgyot6toSeP37WYdEgZH70g
XwWXR//OT0/B7n77EB9jQT/izFBhuea4tTN1mtLHjfQMLCOdLsbF2umTp6A7eg9K
u44ENGbO5sVekDMvUE1QwnKH7LnsKzbQXp7ZYreEVyPBB3FMqcmg5Yob38JKDWmb
/1lSOA3C9NS4SIxXwkNkDHcg/vK2kOWDeGO8/hde/JOnv8tBlUHpTSKC1hF6gv7F
WS66n0dfhKgIHBOma4vU5sXtUdys1wKnjqwgyyWNfKgaoiHrtS66ngVDOkzdBTCX
7Mp1KHm9zFN9zJbugY9un7EoE1ftTbDC2LUbDbz5sg9Sc4delsuzH302emvM6YcD
pIM2ppf6+Q2VLpvCF44TjymU/5p8x+JsqoxVQmqqREcpniKs59ZAhBWcjSfDXRl1
oyNOKpny3uqVoPvgTsX07UUdW5ZW9x/UQWXWSaYWXYXGS/Ul0sCy6eTHjL6RzZAa
OjuzUvMpOjVzuPN2i7hbCWSBhfKv8fzmUtWCCgSoaTNeugDIFrNKBPVauP0cczZQ
iO/91DCwjvyxb0aNX5yg
=YBh8
-----END PGP SIGNATURE-----

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault