Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 21 Oct 2013 20:38:17 +0530
From: Anant Shrivastava <>
Cc:, Ciprian Popescu <>
Subject: CVE for Wordpress plugin Portable-phpmyadmin

Hi Team,

Please issue CVE for following issues identified in a wordpress plugin

*PHP information Disclosure

*Security Bypass *
Allows direct access (with each file level of access differs but you get DB
access with wordpress database username and password)
/pma/main.php - reveals all the details of database stuff.
/pma/server_databases.php - Full access to all features including SQL window

*Disclosure Status.
Author (marked in CC) as well as Wordpress Plugin team (marked in CC) is
aware of the issues.
Wordpress plugin team has disabled the plugin download till issues are
Author initially responded but stopped responding after a point.

First contact : 24 July 2013
Last response from Author : 9 Aug 2013
Wordpress plugin team contacted : 11 Sep 2013
Plugin Disabled in plugin repository : 15 Sep 2013
CVE Requested : 21 Oct 2013

-Anant Shrivastava

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.