CVE-2018-19968: phpMyAdmin Local file inclusion through transformation feature
Summary
CVE-2018-19968: phpMyAdmin Local file inclusion through transformation feature. Affects phpmyadmin/phpmyadmin versions < 4.8.4. Fixed in 4.8.4. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2018-19968 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular web-based database management tool written in PHP. It provides a user-friendly interface for managing MySQL databases. The transformation feature in phpMyAdmin allows users to apply various transformations to the data displayed in the result set. This feature is designed to enhance the usability and presentation of the data. However, a vulnerability in phpMyAdmin versions before 4.8.4 allows an attacker to exploit the transformation feature and leak the contents of a local file. This vulnerability requires the attacker to have access to the phpMyAdmin Configuration Storage tables and valid credentials to log in to phpMyAdmin.
Vulnerability Detail
The vulnerability in phpMyAdmin before version 4.8.4 arises from an error in the transformation feature. An attacker who has access to the phpMyAdmin Configuration Storage tables can create a malicious transformation that includes a local file. When this transformation is applied to the data, phpMyAdmin will attempt to read the contents of the specified file and include it in the result set. This allows the attacker to view the contents of arbitrary files on the server. However, it's important to note that this vulnerability does not provide a way for the attacker to bypass the login system or gain unauthorized access to the server.
How To Fix
Minimum fixed version
4.8.4
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:4.8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of phpMyAdmin as soon as possible.
Conclusion
The vulnerability in phpMyAdmin before version 4.8.4 allows an attacker to leak the contents of local files through the transformation feature. To mitigate this vulnerability, it is crucial to upgrade to the latest version of phpMyAdmin and implement proper access controls. Regularly updating and patching phpMyAdmin is essential for maintaining the security of your database management tool. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is a web-based database management tool for MySQL databases. It provides an intuitive interface for managing databases, tables, and queries.
The transformation feature in phpMyAdmin allows users to apply various transformations to the data displayed in the result set. These transformations can modify the format or presentation of the data.
The vulnerability in phpMyAdmin allows an attacker to include the contents of a local file by exploiting the transformation feature. The attacker needs access to the phpMyAdmin Configuration Storage tables and valid login credentials.
By exploiting this vulnerability, an attacker can view the contents of arbitrary files on the server. However, this vulnerability does not provide a way to bypass the login system or gain unauthorized access to the server.
To protect your phpMyAdmin installation, it is recommended to upgrade to version 4.8.4 or later. Additionally, ensure that you have proper access controls in place to restrict access to the phpMyAdmin Configuration Storage tables.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.