phpMyBackupPro vulnerabilities
5 known CVE vulnerabilities in phpMyBackupPro, translated and rated.
- CVE-2015-3637High
There is an SQL injection vulnerability in phpMyBackupPro when run in multi-user mode before version 2.5, allowing remote attackers to execute arbitrary SQL commands via the username and password parameters.
- CVE-2015-4180High
Directory traversal vulnerability in get_file.php in phpMyBackupPro versions 2.1 through 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter.
- CVE-2015-3640High
phpMyBackupPro version 2.5 and earlier does not properly escape the '.' character in request parameters, allowing remote authenticated users to inject and execute arbitrary PHP scripts.
- CVE-2015-3639High
phpMyBackupPro version 2.5 and earlier does not properly sanitize input strings, allowing remote authenticated users to execute arbitrary PHP code by storing a crafted string in a user configuration file.
- CVE-2015-3638High
phpMyBackupPro before 2.5 does not validate integer input, allowing remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to scheduled.php.