Evil-DB LogoEvil-DB
← All CVEs

CVE-2008-4096

high · 8.5

libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function.

8.5
CVSS
11.2%
EPSS (exploit prob.)
96th
EPSS percentile
2008-09-18
Published

AV:N/AC:M/Au:S/C:C/I:C/A:C

Weaknesses

CWE-20

Affected products

VendorProductAffected versions
phpmyadminphpmyadmin<= 2.11.9
phpmyadminphpmyadmin2.0
phpmyadminphpmyadmin2.0.0
phpmyadminphpmyadmin2.0.1
phpmyadminphpmyadmin2.0.2
phpmyadminphpmyadmin2.0.3
phpmyadminphpmyadmin2.0.4
phpmyadminphpmyadmin2.0.5
phpmyadminphpmyadmin2.1
phpmyadminphpmyadmin2.1.0
phpmyadminphpmyadmin2.1.1
phpmyadminphpmyadmin2.1.2
phpmyadminphpmyadmin2.10.0
phpmyadminphpmyadmin2.10.0.0
phpmyadminphpmyadmin2.10.0.1
phpmyadminphpmyadmin2.10.0.2
phpmyadminphpmyadmin2.10.1
phpmyadminphpmyadmin2.10.01
phpmyadminphpmyadmin2.10.1.0
phpmyadminphpmyadmin2.10.2
phpmyadminphpmyadmin2.10.2.0
phpmyadminphpmyadmin2.10.3
phpmyadminphpmyadmin2.10.3.0
phpmyadminphpmyadmin2.10.3rc1
phpmyadminphpmyadmin2.11.0
phpmyadminphpmyadmin2.11.0.0
phpmyadminphpmyadmin2.11.0beta1
phpmyadminphpmyadmin2.11.0rc1
phpmyadminphpmyadmin2.11.1
phpmyadminphpmyadmin2.11.1.0
phpmyadminphpmyadmin2.11.1.1
phpmyadminphpmyadmin2.11.1.2
phpmyadminphpmyadmin2.11.1rc1
phpmyadminphpmyadmin2.11.2
phpmyadminphpmyadmin2.11.2.0
phpmyadminphpmyadmin2.11.2.1
phpmyadminphpmyadmin2.11.2.2
phpmyadminphpmyadmin2.11.3
phpmyadminphpmyadmin2.11.3.0
phpmyadminphpmyadmin2.11.3rc1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2008-4096