CVE-2013-4729

Published: Jul 4, 2013Modified: Apr 29, 2026

5.5

Vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Exploitability: 8.0 / Impact: 4.9

Source: NVD

Description

import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request.

Affected (7)

Products: Phpmyadmin: Phpmyadmin

Phpmyadmin

1 product

Phpmyadmin

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Phpmyadmin Phpmyadmin	Version 4.0.0
Phpmyadmin Phpmyadmin	Version 4.0.0 rc2
Phpmyadmin Phpmyadmin	Version 4.0.0 rc3
Phpmyadmin Phpmyadmin	Version 4.0.1
Phpmyadmin Phpmyadmin	Version 4.0.2
Phpmyadmin Phpmyadmin	Version 4.0.3
Phpmyadmin Phpmyadmin	Version 4.0.4

Related CWEs

CWE-264

References (4)

http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php

Source: cve@mitre.org

Vendor Advisory

https://github.com/phpmyadmin/phpmyadmin/commit/012464268420e53a9cd81cbb4a43988d70393c36

Source: cve@mitre.org

ExploitPatch

http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://github.com/phpmyadmin/phpmyadmin/commit/012464268420e53a9cd81cbb4a43988d70393c36

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

Timeline

No history available yet.