CVE-2004-1147 phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters.
HighCVSS 10.0
EPSS 11.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmyadmin/phpmyadmin | = 2.4.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 2.5.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 2.5.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 2.5.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 2.5.4 | No fix listed |
| phpmyadmin/phpmyadmin | = 2.5.5 | No fix listed |
| phpmyadmin/phpmyadmin | = 2.5.5_pl1 | No fix listed |
| phpmyadmin/phpmyadmin | = 2.5.5_rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 2.5.5_rc2 | No fix listed |
| phpmyadmin/phpmyadmin | = 2.5.6_rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 2.5.7 | No fix listed |
| phpmyadmin/phpmyadmin | = 2.5.7_pl1 | No fix listed |
| phpmyadmin/phpmyadmin | = 2.6.0_pl1 | No fix listed |
| phpmyadmin/phpmyadmin | = 2.6.0_pl2 | No fix listed |
| phpmyadmin/phpmyadmin | = 2.6.0_pl3 | No fix listed |
| debian/phpmyadmin(Debian:12) | < 2:2.6.1-rc1-1 | 2:2.6.1-rc1-1 |
| debian/phpmyadmin(Debian:13) | < 2:2.6.1-rc1-1 | 2:2.6.1-rc1-1 |
| debian/phpmyadmin(Debian:14) | < 2:2.6.1-rc1-1 | 2:2.6.1-rc1-1 |
References
- Debian Security Tracker CVE-2004-1147 vendor-advisory
- 20041213 Multiple vulnerabilities in phpMyAdmin mailing-list
- www.exaprobe.com
- phpmyadmin-command-execute(18441) vdb-entry