PMASA-2009-1
Announcement-ID: PMASA-2009-1
Date: 2009-03-24
Summary
HTTP Response Splitting and file inclusion vulnerability.
Description
The BLOB streaming feature allowed attacker to include arbitrary files and inject HTTP headers using crafted URL parameters.
Severity
We consider this vulnerability to be critical.
Affected Versions
For 2.11.x: not affected as it lacks BLOB streaming support.<br /> For 3.x: versions since 3.1.0.0 and before 3.1.3.1.<br />
Solution
Upgrade to phpMyAdmin 3.1.3.1 or apply patch listed below.
References
Thanks to Manuel Lopez Gallego (Luisyana) and Santiago Rodríguez Collazo, who have discovered this issue and reported it to us.
Assigned CVE IDs: CVE-2009-1148 CVE-2009-1149
Patches
The following commits have been made to fix this issue:
More information
For further information and in case of questions, please contact the phpMyAdmin security team at security@phpmyadmin.net.