CVE-2019-6799: phpMyAdmin Arbitrary file read vulnerability
Summary
CVE-2019-6799: phpMyAdmin Arbitrary file read vulnerability. Affects phpmyadmin/phpmyadmin versions >= 4.8, < 4.8.5. Fixed in 4.8.5. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2019-6799 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source administration tool for managing MySQL databases. It provides a web-based interface for users to perform various database management tasks. The vulnerability identified as CVE-2019-6799 affects phpMyAdmin versions prior to 4.8.5. This vulnerability arises when the AllowArbitraryServer configuration setting is enabled, allowing an attacker to read any file on the server that the web server's user can access. The issue is related to the mysql.allow_local_infile PHP configuration and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls.
Vulnerability Detail
The vulnerability allows an attacker to exploit the misconfiguration of the AllowArbitraryServer setting in phpMyAdmin. By leveraging a rogue MySQL server, the attacker can read any file on the server that the web server's user has access to. This can lead to unauthorized access to sensitive information, such as database credentials or other confidential data stored on the server. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Minimum fixed version
4.8.5
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:4.8.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of phpMyAdmin is not immediately feasible, a temporary workaround is to disable the AllowArbitraryServer setting. This can be done by modifying the phpMyAdmin configuration file and setting AllowArbitraryServer to false. However, it is strongly advised to upgrade to the latest version as soon as possible to ensure comprehensive security.
Conclusion
The phpMyAdmin Arbitrary file read vulnerability (CVE-2019-6799) allows an attacker to read any file on the server that the web server's user can access. To mitigate this vulnerability, it is crucial to upgrade phpMyAdmin to version 4.8.5 or later and properly configure the mysql.allow_local_infile PHP setting. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source administration tool for managing MySQL databases. It provides a web-based interface for users to perform various database management tasks.
The vulnerability allows an attacker to read any file on the server that the web server's user can access. This can lead to unauthorized access to sensitive information stored on the server.
To fix this vulnerability, it is recommended to upgrade phpMyAdmin to version 4.8.5 or later. Additionally, review and properly configure the mysql.allow_local_infile PHP configuration.
Yes, a temporary workaround is to disable the AllowArbitraryServer setting in the phpMyAdmin configuration file. However, upgrading to the latest version is strongly advised.
The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
