Skip to content
Fencer Intel
high 8.5

CVE-2013-3239 json

phpMyAdmin Remote Code Execution

published 2013-04-26 13 y ago modified 2026-06-16 4 mo ago also GHSA-gg36-9346-9qx9 , EUVD-2022-3948

cvss
8.5
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
8.8%
EPSS 8.8% chance of exploitation in 30 days, percentile 95%
public exploits
1
Exploit-DB

Summary

phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.

Patch / fix

  • packagist phpmyadmin/phpmyadmin 3.5.8.1
  • phpmyadmin Debian 14, Debian 13, Debian 12 4:3.4.11.1-2

debian advisories DEBIAN-CVE-2013-3239

  • phpMyAdmin openSUSE Tumbleweed 4.6.5.2-1.1

opensuse advisories openSUSE-SU-2024:10054-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2013-3239 updated cvss 3.6

phpMyAdmin: remote code execution via locally saved SQL dump file multiple extensions (PMASA-2013-3)

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-25003)
  2. Published

Exploit prediction

8.75% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-25003 phpMyAdmin 3.5.8/4.0.0-RC2 - Multiple Vulnerabilities webapps, 2013-04-25
  • github.com https://github.com/phpmyadmin/phpmyadmin/commit/1f6bc0b707002e26cab216b9e57b4d5de764de48 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P
GitHub 3.1 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
packagist phpmyadmin/phpmyadmin
>=3.5.0, <3.5.8.1
3.5.8.1

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.