Directory Traversal Vulnerability in phpMyAdmin 4.0.10-1ubuntu0.1+esm4
Summary
UBUNTU-CVE-2014-8961: Directory traversal vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to obtain potentially sensi... Affects phpmyadmin versions 4:4.0.10-1 – 4:4.0.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely-used web-based application that allows users to manage MySQL databases through a user-friendly interface. It provides functionalities such as database creation, modification, and administration. However, certain versions of phpMyAdmin are vulnerable to directory traversal attacks, which can lead to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability identified as CVE-2014-8961 is a directory traversal issue found in phpMyAdmin versions 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12. This flaw allows remote authenticated users to exploit the error-reporting feature by manipulating parameters, potentially revealing sensitive information about a file's line count. The risk associated with this vulnerability includes unauthorized access to sensitive data, which could lead to further exploitation or data breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the phpMyAdmin interface by implementing additional authentication measures or by limiting access to trusted IP addresses. This can be done by configuring the web server settings to allow access only from specific IPs.
Conclusion
The directory traversal vulnerability in phpMyAdmin versions 4.0.10-1ubuntu0.1+esm4 poses a significant risk to users, allowing unauthorized access to sensitive information. It is crucial to update to a patched version to mitigate this risk and ensure the security of your database management system.
See every vulnerability recorded for phpmyadmin →
FAQ
A directory traversal vulnerability allows an attacker to access files and directories that are stored outside the web root folder, potentially exposing sensitive information.
You can check your phpMyAdmin version by logging into the application and looking for the version number in the footer or by checking the package version installed on your server.
Failure to address this vulnerability could lead to unauthorized access to sensitive data, which may result in data breaches, loss of data integrity, and potential legal ramifications.
Yes, you can use tools like Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
