CVE-2005-3300
- State
- Published
- Severity
- Not scored
- Published
- Oct 23, 2005
- Updated
- Aug 7, 2024
- Reserved
- Oct 23, 2005
Description
The register_globals emulation layer in grab_globals.php for phpMyAdmin before 2.6.4-pl3 does not perform safety checks on values in the _FILES array for uploaded files, which allows remote attackers to include arbitrary files by using direct requests to library scripts that do not use grab_globals.php, then modifying certain configuration values for the theme.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- SUSE-SR:2005:028vendor-advisory
- SUSE-SA:2005:066vendor-advisory
- 17607third-party-advisory
- 20051022 Advisory 16/2005: phpMyAdmin Local File Inclusion Vulnerabilitymailing-list
- 17559third-party-advisory
- http://www.hardened-php.net/advisory_162005.73.html
- 20051022 Advisory 16/2005: phpMyAdmin Local File Inclusion Vulnerabilitymailing-list
- phpmyadmin-multiple-scripts-file-include(22835)vdb-entry
- DSA-880vendor-advisory
- 17337third-party-advisory
- 15169vdb-entry
- GLSA-200510-21vendor-advisory
- http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5
- 17289third-party-advisory
- 1015091vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.