phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to scheduled.php, and making requests to injected scripts, or by injecting PHP into a PHP configuration variable via a PHP variable variable.
References
| Link | Resource |
|---|---|
| http://openwall.com/lists/oss-security/2015/04/25/1 | Mailing List Patch Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2015/05/04/4 | Mailing List Third Party Advisory |
| http://www.securitytracker.com/id/1032250 | Third Party Advisory VDB Entry |
| http://openwall.com/lists/oss-security/2015/04/25/1 | Mailing List Patch Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2015/05/04/4 | Mailing List Third Party Advisory |
| http://www.securitytracker.com/id/1032250 | Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 02:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://openwall.com/lists/oss-security/2015/04/25/1 - Mailing List, Patch, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2015/05/04/4 - Mailing List, Third Party Advisory | |
| References | () http://www.securitytracker.com/id/1032250 - Third Party Advisory, VDB Entry |
Information
Published : 2017-07-21 14:29
Updated : 2024-11-21 02:29
NVD link : CVE-2015-3638
Mitre link : CVE-2015-3638
CVE.ORG link : CVE-2015-3638
JSON object : View
Products Affected
phpmybackuppro
- phpmybackuppro
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')