Lack of data validation In phpmyadmin
Description
An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 debian 12 | 4:4.6.5.1-1 | ||
 alpine v3.4 | 4.6.5.2-r0 | ||
alpine v3.2 | 4.4.15.9-r0 | ||
debian 13 | 4:4.6.5.1-1 | ||
debian 14 | 4:4.6.5.1-1 |
Aliases
1. 2. 3. 4. 5. 6. 7.