Description
GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remotely access phpMyAdmin and, after uploading a shell, view the config.php file to obtain the MySQL password, leading to full database compromise.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Openeclass | GUnet OpenEclass | 1.7.3 (2007) | — |
References
- ExploitDB-48163 exploit
- Official Vendor Homepage product
- Changelog patch
- VulnCheck Advisory: GUnet OpenEclass 1.7.3 E-learning platform - phpMyAdmin Remote Access third-party-advisory