phpMyAdmin 'simplexml_load_string()' Function Information Disclosure Vulnerability

Bugtraq ID:	50497
Class:	Input Validation Error
CVE:	CVE-2011-4107
Remote:	Yes
Local:	No
Published:	Nov 02 2011 12:00AM
Updated:	Apr 13 2015 09:56PM
Credit:	<br>WooYun
Vulnerable:	Typo3 phpMyAdmin 4.11.8 Typo3 phpMyAdmin 4.11.5 Typo3 phpMyAdmin 4.11.4 Typo3 phpMyAdmin 4.11.2 Typo3 phpMyAdmin 4.11.1 Typo3 phpMyAdmin 4.11 Typo3 phpMyAdmin 4.10.3 phpMyAdmin phpMyAdmin 3.4.6 phpMyAdmin phpMyAdmin 3.4.5 phpMyAdmin phpMyAdmin 3.4.3 phpMyAdmin phpMyAdmin 3.3.8 phpMyAdmin phpMyAdmin 3.3.7 phpMyAdmin phpMyAdmin 3.3.6 phpMyAdmin phpMyAdmin 3.3.5 phpMyAdmin phpMyAdmin 3.3.3 0 phpMyAdmin phpMyAdmin 3.2.2 .1 phpMyAdmin phpMyAdmin 3.2.2 phpMyAdmin phpMyAdmin 3.2.1 phpMyAdmin phpMyAdmin 3.2 phpMyAdmin phpMyAdmin 3.1.5 phpMyAdmin phpMyAdmin 3.1.4 phpMyAdmin phpMyAdmin 3.1.3 phpMyAdmin phpMyAdmin 3.1.1 0 phpMyAdmin phpMyAdmin 3.1.1 .1 phpMyAdmin phpMyAdmin 3.1 .0 phpMyAdmin phpMyAdmin 3.1 phpMyAdmin phpMyAdmin 3.0.1 phpMyAdmin phpMyAdmin 3.0 RC1 phpMyAdmin phpMyAdmin 3.0 beta phpMyAdmin phpMyAdmin 3.0 alpha phpMyAdmin phpMyAdmin 3.0 phpMyAdmin phpMyAdmin 2.11.10 phpMyAdmin phpMyAdmin 2.11.9 4 phpMyAdmin phpMyAdmin 2.11.9 .6 phpMyAdmin phpMyAdmin 2.11.9 .2 phpMyAdmin phpMyAdmin 2.11.9 .1 phpMyAdmin phpMyAdmin 2.11.9 phpMyAdmin phpMyAdmin 2.11.8 phpMyAdmin phpMyAdmin 2.11.7 phpMyAdmin phpMyAdmin 2.11.5 phpMyAdmin phpMyAdmin 2.11.4 phpMyAdmin phpMyAdmin 2.11.1 phpMyAdmin phpMyAdmin 2.11 phpMyAdmin phpMyAdmin 2.9.1 phpMyAdmin phpMyAdmin 2.9 rc1 phpMyAdmin phpMyAdmin 2.9 .2 phpMyAdmin phpMyAdmin 2.9 .1 phpMyAdmin phpMyAdmin 2.9 phpMyAdmin phpMyAdmin 2.8.2 phpMyAdmin phpMyAdmin 2.8.1 phpMyAdmin phpMyAdmin 2.8 .4 phpMyAdmin phpMyAdmin 2.8 .3 phpMyAdmin phpMyAdmin 2.8 .1 phpMyAdmin phpMyAdmin 2.7 .0-beta1 phpMyAdmin phpMyAdmin 2.7 -pl1 phpMyAdmin phpMyAdmin 2.7 phpMyAdmin phpMyAdmin 2.6.4 -rc1 phpMyAdmin phpMyAdmin 2.6.4 -pl4 phpMyAdmin phpMyAdmin 2.6.4 -pl3 phpMyAdmin phpMyAdmin 2.6.4 -pl1 phpMyAdmin phpMyAdmin 2.6.3 -pl1 phpMyAdmin phpMyAdmin 2.6.2 -rc1 phpMyAdmin phpMyAdmin 2.6.2 + Gentoo Linux phpMyAdmin phpMyAdmin 2.6.1 pl3 phpMyAdmin phpMyAdmin 2.6.1 pl1 phpMyAdmin phpMyAdmin 2.6.1 -rc1 phpMyAdmin phpMyAdmin 2.6.1 phpMyAdmin phpMyAdmin 2.6 .0pl3 phpMyAdmin phpMyAdmin 2.6 .0pl2 + Gentoo Linux 1.4 + Gentoo Linux + Gentoo Linux + Gentoo Linux phpMyAdmin phpMyAdmin 2.6 .0pl1 phpMyAdmin phpMyAdmin 2.6 phpMyAdmin phpMyAdmin 2.5.7 pl1 phpMyAdmin phpMyAdmin 2.5.7 phpMyAdmin phpMyAdmin 2.5.6 -rc1 phpMyAdmin phpMyAdmin 2.5.5 pl1 phpMyAdmin phpMyAdmin 2.5.5 -rc2 phpMyAdmin phpMyAdmin 2.5.5 -rc1 phpMyAdmin phpMyAdmin 2.5.5 phpMyAdmin phpMyAdmin 2.5.4 phpMyAdmin phpMyAdmin 2.5.3 + S.u.S.E. Linux Personal 9.3 + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 9.0 phpMyAdmin phpMyAdmin 2.5.2 phpMyAdmin phpMyAdmin 2.5.1 phpMyAdmin phpMyAdmin 2.5 .0 phpMyAdmin phpMyAdmin 2.4 .0 phpMyAdmin phpMyAdmin 2.3.2 phpMyAdmin phpMyAdmin 2.3.1 phpMyAdmin phpMyAdmin 2.2.6 phpMyAdmin phpMyAdmin 2.2.5 phpMyAdmin phpMyAdmin 2.2.4 phpMyAdmin phpMyAdmin 2.2.3 phpMyAdmin phpMyAdmin 2.2.2 phpMyAdmin phpMyAdmin 2.2 rc3 phpMyAdmin phpMyAdmin 2.2 rc2 phpMyAdmin phpMyAdmin 2.2 rc1 phpMyAdmin phpMyAdmin 2.2 pre2 phpMyAdmin phpMyAdmin 2.2 pre1 phpMyAdmin phpMyAdmin 2.2 phpMyAdmin phpMyAdmin 2.1 .2 phpMyAdmin phpMyAdmin 2.1 .1 phpMyAdmin phpMyAdmin 2.1 phpMyAdmin phpMyAdmin 2.0.5 phpMyAdmin phpMyAdmin 2.0.4 phpMyAdmin phpMyAdmin 2.0.3 phpMyAdmin phpMyAdmin 2.0.2 phpMyAdmin phpMyAdmin 2.0.1 phpMyAdmin phpMyAdmin 2.0 phpMyAdmin phpMyAdmin 3.4.5 phpMyAdmin phpMyAdmin 3.4.4 phpMyAdmin phpMyAdmin 3.4.3.2 phpMyAdmin phpMyAdmin 3.4.3.1 phpMyAdmin phpMyAdmin 3.4.1 phpMyAdmin phpMyAdmin 3.4.0-beta1 phpMyAdmin phpMyAdmin 3.4.0 phpMyAdmin phpMyAdmin 3.3.9.2 phpMyAdmin phpMyAdmin 3.3.8.1 phpMyAdmin phpMyAdmin 3.3.6 phpMyAdmin phpMyAdmin 3.3.5.1 phpMyAdmin phpMyAdmin 3.3.5.0 phpMyAdmin phpMyAdmin 3.3.4.0 phpMyAdmin phpMyAdmin 3.3.2.0 phpMyAdmin phpMyAdmin 3.3.10.4 phpMyAdmin phpMyAdmin 3.3.10.3 phpMyAdmin phpMyAdmin 3.3.10.2 phpMyAdmin phpMyAdmin 3.3.10.1 phpMyAdmin phpMyAdmin 3.3.1.0 phpMyAdmin phpMyAdmin 3.3.0.0 phpMyAdmin phpMyAdmin 3.3.0-dev phpMyAdmin phpMyAdmin 3.2.2 Rc1 phpMyAdmin phpMyAdmin 3.2.1-dev phpMyAdmin phpMyAdmin 3.2.1 Rc1 phpMyAdmin phpMyAdmin 3.2.0.1 phpMyAdmin phpMyAdmin 3.2.0-rc1 phpMyAdmin phpMyAdmin 3.2.0 Beta1 phpMyAdmin phpMyAdmin 3.1.5 Rc1 phpMyAdmin phpMyAdmin 3.1.4 Rc2 phpMyAdmin phpMyAdmin 3.1.3.2 phpMyAdmin phpMyAdmin 3.1.3.1 phpMyAdmin phpMyAdmin 3.1.3 Rc1 phpMyAdmin phpMyAdmin 3.1.2 Rc1 phpMyAdmin phpMyAdmin 3.1.2 phpMyAdmin phpMyAdmin 3.1.1 Rc1 phpMyAdmin phpMyAdmin 3.1.1 phpMyAdmin phpMyAdmin 3.1.0 Beta1 phpMyAdmin phpMyAdmin 3.0.1.1 phpMyAdmin phpMyAdmin 3.0.1 Rc1 phpMyAdmin phpMyAdmin 2.9.2-rc1 phpMyAdmin phpMyAdmin 2.9.1.1 phpMyAdmin phpMyAdmin 2.9.0.3 phpMyAdmin phpMyAdmin 2.7.0-pl2 phpMyAdmin phpMyAdmin 2.5.11.2 phpMyAdmin phpMyAdmin 2.11.9.5. phpMyAdmin phpMyAdmin 2.11.9.5 phpMyAdmin phpMyAdmin 2.11.9.4 phpMyAdmin phpMyAdmin 2.11.9.3 phpMyAdmin phpMyAdmin 2.11.9.0 phpMyAdmin phpMyAdmin 2.11.8.1 phpMyAdmin phpMyAdmin 2.11.8.0 phpMyAdmin phpMyAdmin 2.11.7.12.11.7.1 phpMyAdmin phpMyAdmin 2.11.7.1 phpMyAdmin phpMyAdmin 2.11.7.0 phpMyAdmin phpMyAdmin 2.11.6.0 phpMyAdmin phpMyAdmin 2.11.5.2 phpMyAdmin phpMyAdmin 2.11.5.1 phpMyAdmin phpMyAdmin 2.11.5.0 phpMyAdmin phpMyAdmin 2.11.4.0 phpMyAdmin phpMyAdmin 2.11.3.0 phpMyAdmin phpMyAdmin 2.11.2.2 phpMyAdmin phpMyAdmin 2.11.2.1 phpMyAdmin phpMyAdmin 2.11.2.0 phpMyAdmin phpMyAdmin 2.11.11.3 phpMyAdmin phpMyAdmin 2.11.11.1 phpMyAdmin phpMyAdmin 2.11.10.1 phpMyAdmin phpMyAdmin 2.11.10.0 phpMyAdmin phpMyAdmin 2.11.10-dev phpMyAdmin phpMyAdmin 2.11.1.2 phpMyAdmin phpMyAdmin 2.11.1.1 phpMyAdmin phpMyAdmin 2.11.1.0 phpMyAdmin phpMyAdmin 2.11 phpMyAdmin phpMyAdmin 2.10.0.2 phpMyAdmin phpMyAdmin 2.10.0.1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	Typo3 phpMyAdmin 4.11.9

phpMyAdmin 'simplexml_load_string()' Function Information Disclosure Vulnerability

phpMyAdmin is prone to a remote information-disclosure vulnerability.

Exploiting this issue will allow an attacker to read arbitrary files within the context of the webserver. Information harvested may aid in launching further attacks.

phpMyAdmin 'simplexml_load_string()' Function Information Disclosure Vulnerability

Attackers can use a browser to exploit this issue.

The following exploit is available:

• /data/vulnerabilities/exploits/50497.rb

phpMyAdmin 'simplexml_load_string()' Function Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.


MandrakeSoft Enterprise Server 5

• Mandriva phpmyadmin-3.4.9-0.1mdvmes5.2.noarch.rpm
  http://www.mandriva.com/en/downloads/

phpMyAdmin 'simplexml_load_string()' Function Information Disclosure Vulnerability

References:

• phpMyAdmin Homepage (phpMyAdmin)
  
• TYPO3 Security Bulletin TYPO3-EXT-SA-2011-018: Multiple vulnerabilities in exten (TYPO3 )
  
• Vulnerability in phpMyAdmin (WooYun)