Description
The register_globals emulation in phpMyAdmin 2.7.0 rc1 allows remote attackers to exploit other vulnerabilities in phpMyAdmin by modifying the import_blacklist variable in grab_globals.php, which can then be used to overwrite other variables.
References
- SUSE-SA:2006:004 vendor-advisory
- 237 third-party-advisory
- http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0
- GLSA-200512-03 vendor-advisory
- 15761 vdb-entry
- 17925 third-party-advisory
- http://www.hardened-php.net/advisory_252005.110.html
- 17957 third-party-advisory
- 20051207 Advisory 25/2005: phpMyAdmin Variables Overwrite Vulnerability mailing-list
- 18618 third-party-advisory
- ADV-2005-2792 vdb-entry
- 21508 vdb-entry
- http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9