Lack of data validation - Path Traversal In phpmyadmin/phpmyadmin
Description
phpMyAdmin Arbitrary file read vulnerability An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 packagist | 4.8.5 | ||
 debian 13 | 4:4.9.1+dfsg1-2 | ||
debian 11 | 4:4.9.1+dfsg1-2 | ||
debian 12 | 4:4.9.1+dfsg1-2 |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3.