GitHub Advisoryadvisory · Packagist

GHSA-xrpq-63mp-9vcw phpMyAdmin HTTP Response Splitting Vulnerability

HIGH Published 2022-05-02 Modified 2024-01-23 Official page ↗
Aliases
CVE-2009-1149
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
High
Weaknesses
CWE-113, CWE-20
Reviewed
2024-01-23

Affected packages

• Packagist phpmyadmin/phpmyadmin: < 3.1.3.1 → fixed in 3.1.3.1

Description

CRLF injection vulnerability in `bs_disp_as_mime_type.php` in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the (1) `c_type` and possibly (2) `file_type` parameters.

Related

Alias · CVE (1)

  • CVE-2009-1149 CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers… vulnerability

Weakness · CWE (2)

  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers weakness
  • CWE-20 Improper Input Validation weakness

References