PMASA-2013-5
Announcement-ID: PMASA-2013-5
Date: 2013-04-24
Summary
Global variables overwrite in "export.php".
Description
The export script generates global variables from those present in the $$_POST superglobal. This may lead to other exploits in the export script.
Severity
We consider this vulnerability to be serious.
Mitigation factor
This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users to access the required form.
Affected Versions
phpMyAdmin versions 4.x (prior to 4.0.0-rc3).
Solution
Upgrade to phpMyAdmin 4.0.0-rc3 or newer.
References
Thanks to Janek Vind for reporting this issue.
Assigned CVE IDs: CVE-2013-3241
CWE IDs: CWE-661
More information
For further information and in case of questions, please contact the phpMyAdmin security team at security@phpmyadmin.net.