GitHub Advisoryadvisory · Packagist

GHSA-c8wj-q36q-3wg4 phpMyAdmin Arbitrary file read vulnerability

MEDIUM Published 2022-05-13 Modified 2024-04-24 Official page ↗
Aliases
CVE-2019-6799
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2024-04-24

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 4.8, < 4.8.5 → fixed in 4.8.5

Description

An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls.

Related

Alias · CVE (1)

  • CVE-2019-6799 An issue was discovered in phpMyAdmin before 4.8.5. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References