Hello list! I want to warn you about Brute Force and Full path disclosure vulnerabilities in phpMyAdmin. CVE id: CVE-2011-0986. WASC ids: WASC-11, WASC-13. CWE ids: CWE-661, CWE-200. ------------------------- Affected products: ------------------------- Vulnerable are phpMyAdmin 3.3.9 and previous versions and phpMyAdmin 2.11.11.1 and previous versions. All applications (such as XAMPP), which are using phpMyAdmin, are also vulnerable. Full path disclosure vulnerabilities were fixed by developers in versions 3.3.9.1 and 2.11.11.2. ---------- Details: ---------- Brute Force (WASC-11): http://site/phpmyadmin/ In login form there is no protection from Brute Force attacks. Full path disclosure (WASC-13): http://site/phpmyadmin/readme.php (if there is no README file in folder phpmyadmin) http://site/phpmyadmin/changelog.php (if there is no ChangeLog file in folder phpmyadmin) http://site/phpmyadmin/license.php (if there is no LICENSE file in folder phpmyadmin) ------------ Timeline: ------------ 2011.01.25 - announced at my site. 2011.01.26 - informed developers. 2011.01.31 - received answer from developers. 2011-02-01 - I gave developers additional argumentations and recommendations about fixing Brute Force and Full path disclosure holes and privately informed about all those Fingerprinting (WASC-45) holes in phpMyAdmin. 2011-02-08 - developers fixed FPD holes (http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php). 2011.02.28 - disclosed at my site. I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/4872/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua