Main
Vulnerability Database
Exploits
ID:4225 - Exploit for Code Injection in phpMyAdmin - CVE-2013-3239
ID:4225 - Exploit for Code Injection in phpMyAdmin - CVE-2013-3239
Published: August 11, 2020
Vulnerability identifier: #VU42865
Vulnerability risk: Low
CVE-ID: CVE-2013-3239
CWE-ID: CWE-94
Exploitation vector: Remote access
Vulnerable software:
phpMyAdmin
phpMyAdmin
Link to public exploit:
Vulnerability description
The vulnerability allows a remote #AU# to read and manipulate data.
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.
Remediation
Install update from vendor's website.