CVE-2005-3300
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2005-3300
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2005-3300.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2005-3300
- Downstream
- Published
- 2005-10-23T21:02:00Z
- Modified
- 2025-08-09T20:01:26Z
- Summary
- [none]
- Details
-
The registerglobals emulation layer in grabglobals.php for phpMyAdmin before 2.6.4-pl3 does not perform safety checks on values in the FILES array for uploaded files, which allows remote attackers to include arbitrary files by using direct requests to library scripts that do not use grabglobals.php, then modifying certain configuration values for the theme.
- References
-
- http://secunia.com/advisories/17289/
- http://secunia.com/advisories/17337
- http://secunia.com/advisories/17559
- http://secunia.com/advisories/17607
- http://www.debian.org/security/2005/dsa-880
- http://www.hardened-php.net/advisory_162005.73.html
- http://www.novell.com/linux/security/advisories/2005_28_sr.html
- http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html
- http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5
- http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0478.
- http://marc.info/?l=bugtraq&m=113017591414699&w=2
- http://securitytracker.com/id?1015091
- http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml
- http://www.securityfocus.com/bid/15169
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22835