CVE-2005-3300

The register_globals emulation layer in grab_globals.php for phpMyAdmin before 2.6.4-pl3 does not perform safety checks on values in the _FILES array for uploaded files, which allows remote attackers to include arbitrary files by using direct requests to library scripts that do not use grab_globals.php, then modifying certain configuration values for the theme.

• http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0478.
• http://marc.info/?l=bugtraq&m=113017591414699&w=2
• http://secunia.com/advisories/17289/
• http://secunia.com/advisories/17337
• http://secunia.com/advisories/17559
• http://secunia.com/advisories/17607
• http://securitytracker.com/id?1015091
• http://www.debian.org/security/2005/dsa-880
• http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml
• http://www.hardened-php.net/advisory_162005.73.htmlPatch, Vendor Advisory
• http://www.novell.com/linux/security/advisories/2005_28_sr.html
• http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html
• http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5Patch, Vendor Advisory
• http://www.securityfocus.com/bid/15169
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22835
• http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0478.
• http://marc.info/?l=bugtraq&m=113017591414699&w=2
• http://secunia.com/advisories/17289/
• http://secunia.com/advisories/17337
• http://secunia.com/advisories/17559
• http://secunia.com/advisories/17607
• http://securitytracker.com/id?1015091
• http://www.debian.org/security/2005/dsa-880
• http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml
• http://www.hardened-php.net/advisory_162005.73.htmlPatch, Vendor Advisory
• http://www.novell.com/linux/security/advisories/2005_28_sr.html
• http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html
• http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5Patch, Vendor Advisory
• http://www.securityfocus.com/bid/15169
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22835

Published

Oct 23, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-3294Typsoft FTP Server 1.11, with "Sub Directory Include" enable…
• CVE-2005-3295Unspecified vulnerability in HP-UX B.11.23 on Itanium platfo…
• CVE-2005-3296The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows …
• CVE-2005-3297Multiple integer overflows in OpenWBEM on SuSE Linux 9 allow…
• CVE-2005-3298Multiple buffer overflows in OpenWBEM on SuSE Linux 9 allow …
• CVE-2005-3299PHP file inclusion vulnerability in grab_globals.lib.php in …
• CVE-2005-3301Multiple cross-site scripting (XSS) vulnerabilities in phpMy…
• CVE-2005-3302Eval injection vulnerability in bvh_import.py in Blender 2.3…7.3
• CVE-2005-3303The FSG unpacker (fsg.c) in Clam AntiVirus (ClamAV) 0.80 thr…
• CVE-2005-3304Multiple SQL injection vulnerabilities in PHP-Nuke 7.8 allow…
• CVE-2005-3305Multiple SQL injection vulnerabilities in Nuked Klan 1.7 all…
• CVE-2005-3306Cross-site scripting (XSS) vulnerability in index.php for Fl…