GitHub Advisoryadvisory · Packagist

GHSA-xc97-r49q-cxgc phpMyAdmin Local file inclusion through transformation feature

MEDIUM Published 2022-05-14 Modified 2024-04-24 Official page ↗
Aliases
CVE-2018-19968
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-04-24

Affected packages

• Packagist phpmyadmin/phpmyadmin: < 4.8.4 → fixed in 4.8.4

Description

An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.

Related

Alias · CVE (1)

  • CVE-2018-19968 An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References