CVE-2021-47853
CVE-2021-47853 · phpPgAdmin contains a remote command execution vulnerability
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
phpPgAdmin 7.13.0 contains a remote command execution vulnerability that allows authenticated attackers to execute arbitrary system commands through SQL query manipulation. Attackers can create a custom table, upload a malicious .txt file, and use the COPY FROM PROGRAM command to execute operating system commands with the application's privileges.
CVSS 8.8 · Élevée
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
phppgadmin/phppgadmin Packagist
- Plages de versions concernées
- ECOSYSTEM: ≤ 7.13.0
Aucun correctif publié
Sources originales
- https://nvd.nist.gov/vuln/detail/CVE-2021-47853
- https://github.com/phppgadmin/phppgadmin
- https://github.com/phppgadmin/phppgadmin/releases
- https://www.exploit-db.com/exploits/49736
- https://www.vulncheck.com/advisories/phppgadmin-copy-from-program-command-execution
- https://osv.dev/vulnerability/GHSA-86gh-c8r8-xwhq