CVE-2008-4096 (GCVE-0-2008-4096)

Vulnerability from cvelistv5 – Published: 2008-09-17 18:06 – Updated: 2024-08-07 10:00
VLAI
Summary
libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://www.mandriva.com/security/advisories?name=… vendor-advisoryx_refsource_MANDRIVA
http://secunia.com/advisories/31884 third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31918 third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
https://www.redhat.com/archives/fedora-package-an… vendor-advisoryx_refsource_FEDORA
http://www.vupen.com/english/advisories/2008/2585 vdb-entryx_refsource_VUPEN
https://www.redhat.com/archives/fedora-package-an… vendor-advisoryx_refsource_FEDORA
http://osvdb.org/48196 vdb-entryx_refsource_OSVDB
https://bugzilla.redhat.com/show_bug.cgi?id=462430 x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2008/09/15/2 mailing-listx_refsource_MLIST
http://typo3.org/teams/security/security-bulletin… x_refsource_CONFIRM
http://security.gentoo.org/glsa/glsa-200903-32.xml vendor-advisoryx_refsource_GENTOO
https://www.redhat.com/archives/fedora-package-an… vendor-advisoryx_refsource_FEDORA
https://www.redhat.com/archives/fedora-package-an… vendor-advisoryx_refsource_FEDORA
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.debian.org/security/2008/dsa-1641 vendor-advisoryx_refsource_DEBIAN
http://secunia.com/advisories/33822 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/31188 vdb-entryx_refsource_BID
http://www.phpmyadmin.net/home_page/security.php?… x_refsource_CONFIRM
http://secunia.com/advisories/32034 third-party-advisoryx_refsource_SECUNIA
http://www.nabble.com/phpMyAdmin-2.11.9.1-is-rele… mailing-listx_refsource_MLIST
http://fd.the-wildcat.de/pma_e36a091q11.php x_refsource_MISC
http://www.openwall.com/lists/oss-security/2008/09/16/2 mailing-listx_refsource_MLIST
http://www.vupen.com/english/advisories/2008/2619 vdb-entryx_refsource_VUPEN
Date Public
2008-09-15 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T10:00:42.597Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "MDVSA-2008:202",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
          },
          {
            "name": "31884",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31884"
          },
          {
            "name": "31918",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31918"
          },
          {
            "name": "SUSE-SR:2009:003",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
          },
          {
            "name": "FEDORA-2008-8370",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01290.html"
          },
          {
            "name": "ADV-2008-2585",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2585"
          },
          {
            "name": "FEDORA-2008-8269",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01137.html"
          },
          {
            "name": "48196",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/48196"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=462430"
          },
          {
            "name": "[oss-security] 20080915 phpMyAdmin code execution (CVE request)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2008/09/15/2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/"
          },
          {
            "name": "GLSA-200903-32",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
          },
          {
            "name": "FEDORA-2008-8335",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01228.html"
          },
          {
            "name": "FEDORA-2008-8286",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01155.html"
          },
          {
            "name": "phpmyadmin-serverdatabases-code-execution(45157)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45157"
          },
          {
            "name": "DSA-1641",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2008/dsa-1641"
          },
          {
            "name": "33822",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33822"
          },
          {
            "name": "31188",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/31188"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7"
          },
          {
            "name": "32034",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32034"
          },
          {
            "name": "[phpmyadmin-news] 20080915 phpMyAdmin 2.11.9.1 is released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://fd.the-wildcat.de/pma_e36a091q11.php"
          },
          {
            "name": "[oss-security] 20080915 Re: phpMyAdmin code execution (CVE request)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2008/09/16/2"
          },
          {
            "name": "ADV-2008-2619",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2619"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-09-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-07T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "MDVSA-2008:202",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
        },
        {
          "name": "31884",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31884"
        },
        {
          "name": "31918",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31918"
        },
        {
          "name": "SUSE-SR:2009:003",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
        },
        {
          "name": "FEDORA-2008-8370",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01290.html"
        },
        {
          "name": "ADV-2008-2585",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2585"
        },
        {
          "name": "FEDORA-2008-8269",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01137.html"
        },
        {
          "name": "48196",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/48196"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=462430"
        },
        {
          "name": "[oss-security] 20080915 phpMyAdmin code execution (CVE request)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2008/09/15/2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/"
        },
        {
          "name": "GLSA-200903-32",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
        },
        {
          "name": "FEDORA-2008-8335",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01228.html"
        },
        {
          "name": "FEDORA-2008-8286",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01155.html"
        },
        {
          "name": "phpmyadmin-serverdatabases-code-execution(45157)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45157"
        },
        {
          "name": "DSA-1641",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2008/dsa-1641"
        },
        {
          "name": "33822",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33822"
        },
        {
          "name": "31188",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/31188"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7"
        },
        {
          "name": "32034",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32034"
        },
        {
          "name": "[phpmyadmin-news] 20080915 phpMyAdmin 2.11.9.1 is released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://fd.the-wildcat.de/pma_e36a091q11.php"
        },
        {
          "name": "[oss-security] 20080915 Re: phpMyAdmin code execution (CVE request)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2008/09/16/2"
        },
        {
          "name": "ADV-2008-2619",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2619"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-4096",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "MDVSA-2008:202",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
            },
            {
              "name": "31884",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31884"
            },
            {
              "name": "31918",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31918"
            },
            {
              "name": "SUSE-SR:2009:003",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
            },
            {
              "name": "FEDORA-2008-8370",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01290.html"
            },
            {
              "name": "ADV-2008-2585",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2585"
            },
            {
              "name": "FEDORA-2008-8269",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01137.html"
            },
            {
              "name": "48196",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/48196"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=462430",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=462430"
            },
            {
              "name": "[oss-security] 20080915 phpMyAdmin code execution (CVE request)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2008/09/15/2"
            },
            {
              "name": "http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/",
              "refsource": "CONFIRM",
              "url": "http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/"
            },
            {
              "name": "GLSA-200903-32",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
            },
            {
              "name": "FEDORA-2008-8335",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01228.html"
            },
            {
              "name": "FEDORA-2008-8286",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01155.html"
            },
            {
              "name": "phpmyadmin-serverdatabases-code-execution(45157)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45157"
            },
            {
              "name": "DSA-1641",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2008/dsa-1641"
            },
            {
              "name": "33822",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33822"
            },
            {
              "name": "31188",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/31188"
            },
            {
              "name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7",
              "refsource": "CONFIRM",
              "url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7"
            },
            {
              "name": "32034",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32034"
            },
            {
              "name": "[phpmyadmin-news] 20080915 phpMyAdmin 2.11.9.1 is released",
              "refsource": "MLIST",
              "url": "http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html"
            },
            {
              "name": "http://fd.the-wildcat.de/pma_e36a091q11.php",
              "refsource": "MISC",
              "url": "http://fd.the-wildcat.de/pma_e36a091q11.php"
            },
            {
              "name": "[oss-security] 20080915 Re: phpMyAdmin code execution (CVE request)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2008/09/16/2"
            },
            {
              "name": "ADV-2008-2619",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2619"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-4096",
    "datePublished": "2008-09-17T18:06:00.000Z",
    "dateReserved": "2008-09-15T00:00:00.000Z",
    "dateUpdated": "2024-08-07T10:00:42.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2008-4096",
      "date": "2026-09-30",
      "epss": "0.11175",
      "percentile": "0.95822"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D221D53F-B6ED-4AA6-BF41-B72E9BEA513A",
                    "versionEndIncluding": "2.11.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "61A423F0-91C8-48C9-A6B1-46DBB1A31DC1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "784EF815-B20A-4D26-8FCA-04BCBAD65BDD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CABC8407-173D-466B-B366-5F7F5D9F2F14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "91ABFE90-9D9D-40FD-A2ED-A7021DFCC301",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CAA8D87A-D161-4CC4-8E71-FD2407EA247E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7E6C869A-0307-40D9-85D6-05453B6BEA35",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CABB8831-0951-4E3B-B983-FC390A622FEC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BEE37166-AC6C-473A-8266-38417C6F2167",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CAC01AB6-A640-45FF-8971-593A49AD3694",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.01:*:*:*:*:*:*:*",
                    "matchCriteriaId": "65D9D3A9-CC69-40B7-9FBF-9A18A4342FB0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "37C15B2C-D4A9-4946-8EB9-B6C131D6E8D1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "439ED5A5-7720-4FB4-AFE9-D6F2625D98D0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "795B4F23-BA5E-466B-9FC3-C7A00A110774",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F57B4C9F-FF70-44D4-9577-FE6C4BC69828",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4EC1F099-04AC-4210-8477-07B21E087162",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3rc1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D86CCE3D-61C1-4A9D-8A54-3D14B9C5BCBF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "962B49A9-380D-4B19-929B-50793EF621C1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0beta1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AEC66C23-0133-4A39-B8C0-BCFF6F1E4D6E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0rc1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8F3A44D6-F174-428E-8456-5B7B093D7A64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1rc1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EF6D9CF4-C9D6-4CDE-86F4-BA46913CE8EC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3rc1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CD5CB748-A953-4CAD-B8F9-21F43D2992E2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2909BBB8-AB67-45DC-BAF0-015CBF97AFD8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4rc1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A4843917-B7B1-4871-AE2B-2219C6EB85F7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "80E1F897-861F-4E10-8E05-3C0DD60C7979",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5rc1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A217F2AE-185D-4385-8804-475DB12CFA0E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DE432385-9FC2-4EB3-9770-4CA9A2979019",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6rc1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CC99B93D-2171-40DE-90B3-61D6DB9F6D47",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AE588389-7B4F-4949-BB7A-233C6BE31859",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4B9AA2E6-CF57-40A1-9A9C-B704D8B009F2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function."
          },
          {
            "lang": "es",
            "value": "libraries/database_interface.lib.php en phpMyAdmin anterior a 2.11.9.1, permite a usuarios autenticados en remoto ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de una solicitud a server_databases.php con un par\u00e1metro sort_by que contenga secuencias PHP que son procesadas por create_function."
          }
        ],
        "id": "CVE-2008-4096",
        "lastModified": "2026-04-23T00:35:47.467",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "COMPLETE",
                "baseScore": 8.5,
                "confidentialityImpact": "COMPLETE",
                "integrityImpact": "COMPLETE",
                "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
                "version": "2.0"
              },
              "exploitabilityScore": 6.8,
              "impactScore": 10.0,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2008-09-18T15:04:27.327",
        "references": [
          {
            "source": "cve@mitre.org",
            "url": "http://fd.the-wildcat.de/pma_e36a091q11.php"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://osvdb.org/48196"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/31884"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/31918"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/32034"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/33822"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.debian.org/security/2008/dsa-1641"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch"
            ],
            "url": "http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2008/09/15/2"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.openwall.com/lists/oss-security/2008/09/16/2"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit"
            ],
            "url": "http://www.securityfocus.com/bid/31188"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2008/2585"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2008/2619"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=462430"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45157"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01137.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01155.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01228.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01290.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://fd.the-wildcat.de/pma_e36a091q11.php"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://osvdb.org/48196"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/31884"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/31918"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/32034"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/33822"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.debian.org/security/2008/dsa-1641"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2008/09/15/2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.openwall.com/lists/oss-security/2008/09/16/2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit"
            ],
            "url": "http://www.securityfocus.com/bid/31188"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2008/2585"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2008/2619"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=462430"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45157"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01137.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01155.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01228.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01290.html"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-11-21T13:14:59+00:00",
      "cve": "CVE-2008-4096",
      "id": "CVE-2008-4096",
      "initial_release_date": "2008-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "phpMyAdmin: Code execution vulnerability (\u003c 2.11.9.1)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2008/cve-2008-4096.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.