Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE for Wordpress plugin Portable-phpmyadmin
From: Kurt Seifried <kseifried () redhat com>
Date: Mon, 21 Oct 2013 23:46:07 -0600

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/21/2013 08:45 PM, Anant Shrivastava wrote:
Old download URL http://wordpress.org/plugins/portable-phpmyadmin/ 
As already informed the download link will not work as it is
disabled by word press plugin team

Svn repository
http://plugins.svn.wordpress.org/portable-phpmyadmin/

Effected version 1.4.1

-Anant

Thanks, please use CVE-2013-4454 for this issue.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On 10/21/2013 09:08 AM, Anant Shrivastava wrote:
Hi Team,

Please issue CVE for following issues identified in a wordpress 
plugin portable-phpmyadmin


*PHP information Disclosure * /pma/phpinfo.php

*Security Bypass * Allows direct access (with each file level of 
access differs but you get DB access with wordpress database 
username and password) /pma/db_create.php /pma/main.php -
reveals all the details of database stuff. /pma/db_datadict.php 
/pma/import.php /pma/querywindow.php /pma/server_databases.php - 
Full access to all features including SQL window 
/pma/server_export.php


*Disclosure Status. * Author (marked in CC) as well as Wordpress 
Plugin team (marked in CC) is aware of the issues. Wordpress
plugin team has disabled the plugin download till issues are
resolved. Author initially responded but stopped responding after
a point.

*Timeline* First contact : 24 July 2013 Last response from Author
: 9 Aug 2013 Wordpress plugin team contacted : 11 Sep 2013
Plugin Disabled in plugin repository : 15 Sep 2013 CVE Requested
: 21 Oct 2013


-Anant Shrivastava


Can you post the url/download link for this app?

- -- Kurt Seifried Red Hat Security Response Team (SRT) PGP:
0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux)

iQIcBAEBAgAGBQJSZYssAAoJEBYNRVNeJnmTPJgQANtKvnRl4scnR98T1mye1qwB 
14IqpjNgQhYnhajrEUK+heJhudbIN4CS4Mwu01mVIoUdj2GKBP0iRgdc9vBJCDSY 
FbVfGjshuQvCKMDd1KGRcKPJG0fxnDk+CKk0HDP/pwgyot6toSeP37WYdEgZH70g 
XwWXR//OT0/B7n77EB9jQT/izFBhuea4tTN1mtLHjfQMLCOdLsbF2umTp6A7eg9K 
u44ENGbO5sVekDMvUE1QwnKH7LnsKzbQXp7ZYreEVyPBB3FMqcmg5Yob38JKDWmb 
/1lSOA3C9NS4SIxXwkNkDHcg/vK2kOWDeGO8/hde/JOnv8tBlUHpTSKC1hF6gv7F 
WS66n0dfhKgIHBOma4vU5sXtUdys1wKnjqwgyyWNfKgaoiHrtS66ngVDOkzdBTCX 
7Mp1KHm9zFN9zJbugY9un7EoE1ftTbDC2LUbDbz5sg9Sc4delsuzH302emvM6YcD 
pIM2ppf6+Q2VLpvCF44TjymU/5p8x+JsqoxVQmqqREcpniKs59ZAhBWcjSfDXRl1 
oyNOKpny3uqVoPvgTsX07UUdW5ZW9x/UQWXWSaYWXYXGS/Ul0sCy6eTHjL6RzZAa 
OjuzUvMpOjVzuPN2i7hbCWSBhfKv8fzmUtWCCgSoaTNeugDIFrNKBPVauP0cczZQ 
iO/91DCwjvyxb0aNX5yg =YBh8 -----END PGP SIGNATURE-----



- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)

iQIcBAEBAgAGBQJSZhEfAAoJEBYNRVNeJnmTLYoQAIkwD3+V8iZ4sakOP2crVHDJ
+fWEsRJr+AuAypYI23BrLP11tvPiYiDQgudx4GjSwF7Bm63YFVEHiD14FpaywvMC
sq/DFZ8m/5W44YqLk4/sv17kRHyjHqUlccYsl/QEga9Cupz8kc3oe/RzvhmN2NYH
UUccsonfpdhfRgRqWyOlXccNrNNUObsIupHBNHPt163EzihBRq4Cnhe1PGvryPih
o+N55gtuLT1+yvNHDJ+nlt04VGlKGleQcg6IvIFQvEZTj9IuLZyhQFktbTx77uOZ
WRMGjQxtxlydwVdLPXld/3X9GNjkd22YHuC+T9K2fUFDCxKgNBq99J15JweTEJ5B
UjHD+id8OYs0DWFSJ4HmVIi6xf4F/si9zAB24Dy/iNmhQtcjXjE+uFZQrxq6yfYX
RS/dKpXUtl6OztKVCb5uxIUSW2mWfveauFklgEL6+PiLG6/YihN8q9JZb1lNReh3
ackL9OMWcOSCmlXIn2d4nCBbEPrDIrGdMayGImXJf0isK/pk8eflOk4u3aD4ZTbR
dChwNO+apqqhNCq6JkWOI7kJy3sn8qxd382gB7F0iGng6XbkEqY1xT8v+eoFBRaL
SsnUEiqKmzM1E88EfMmbdVKL8h4PiQnuYRcoDqy74Bo2Y6C8muDNvulonWs6GAd3
Z6jDnb4J+WQgj7eTc/Pd
=KB5p
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault