| Vulnerability Name: | CVE-2005-2256 (CCN-21265) | ||||||||
| Assigned: | 2005-07-07 | ||||||||
| Published: | 2005-07-07 | ||||||||
| Updated: | 2008-09-05 | ||||||||
| Summary: | Encoded directory traversal vulnerability in phpPgAdmin 3.1 to 3.5.3 allows remote attackers to access arbitrary files via "%2e%2e%2f" (encoded dot dot) sequences in the formLanguage parameter. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MLIST Type: UNKNOWN [Dailydave] 20050704 !!! pre-authenticated remote code inclusion vulnerability inside phppgadmin !!! Source: MITRE Type: CNA CVE-2005-2256 Source: CCN Type: SA15941 phpPgAdmin "formLanguage" Local File Inclusion Vulnerability Source: SECUNIA Type: Vendor Advisory 15941 Source: SECUNIA Type: UNKNOWN 16116 Source: CCN Type: SECTRACK ID: 1014414 phpPgAdmin Input Validation Hole in `formLanguage` Discloses Files to Remote Users Source: SECTRACK Type: Exploit 1014414 Source: CONFIRM Type: UNKNOWN http://sourceforge.net/project/shownotes.php?release_id=342261 Source: CCN Type: phpPgAdmin Web page Project: phpPgAdmin: Summary Source: DEBIAN Type: UNKNOWN DSA-759 Source: DEBIAN Type: DSA-759 phppgadmin -- missing input sanitising Source: CCN Type: OSVDB ID: 17758 phpPgAdmin index.php formLanguage Parameter Local File Inclusion Source: BID Type: Exploit 14142 Source: CCN Type: BID-14142 PHPPGAdmin Login Form Directory Traversal Vulnerability Source: MISC Type: Vendor Advisory http://www.vuxml.org/freebsd/88188a8c-eff6-11d9-8310-0001020eed82.html Source: XF Type: UNKNOWN phppgadmin-formlanguage-file-include(21265) | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||