RCE in Avinu Phpmoadmin
CVE-2015-2208
The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the object parameter.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.881 (99.5th percentile) — read the EPSS interpretation.
Affected products
- Avinu Phpmoadmin — versions 1.1.2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 20150304 PHPMoAdmin Unauthorized Remote Code Execution (0-Day) (mailing-list, Exploit, x_refsource_FULLDISC)
- cve@mitre.org (Exploit, x_refsource_MISC)
- 36251 (Exploit, exploit, x_refsource_EXPLOIT-DB)
- [oss-security] 20150304 CVE request: PHPMoAdmin Unauthorized Remote Code Execution (mailing-list, x_refsource_MLIST, Exploit)
- [oss-security] 20150304 Re: CVE request: PHPMoAdmin Unauthorized Remote Code Execution (mailing-list, x_refsource_MLIST, Exploit)
Frequently asked questions
- What is CVE-2015-2208?
- CVE-2015-2208 is a vulnerability in Avinu Phpmoadmin, classified under Command Injection. Published 2015-03-12.
- Is CVE-2015-2208 known to be exploited?
- 19 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.