Critical Vulnerability in phpMyAdmin: Local File Disclosure Risk
Summary
UBUNTU-CVE-2018-19968: An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. Affects phpmyadmin versions < 4:4.0.10-1ubuntu0.1+esm4. Fixed in 4:4.0.10-1ubuntu0.1+esm4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely used web-based database management tool for MySQL and MariaDB. It allows users to manage databases through a user-friendly interface, providing functionalities such as executing SQL queries, managing users, and importing/exporting data. However, certain versions of phpMyAdmin are vulnerable to a local file disclosure issue, which can lead to unauthorized access to sensitive information stored on the server.
Vulnerability Detail
The vulnerability identified as CVE-2018-19968 affects phpMyAdmin versions prior to 4.8.4. It arises from an error in the transformation feature, allowing an attacker with valid credentials to exploit the system and leak the contents of local files. The attacker must have access to the phpMyAdmin Configuration Storage tables, which can be created in any accessible database. This vulnerability does not bypass the login system but can expose sensitive data if exploited.
How To Fix
Minimum fixed version
4:4.0.10-1ubuntu0.1+esm4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict access to phpMyAdmin by implementing IP whitelisting or using a VPN to limit exposure. Additionally, ensure that sensitive files are not accessible through the web server.
Conclusion
The vulnerability CVE-2018-19968 poses a significant risk to phpMyAdmin users, allowing potential local file disclosure. It is crucial to update to the latest patched versions to mitigate this risk. Users should also consider implementing workarounds until they can apply the necessary updates.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2018-19968 is a vulnerability in phpMyAdmin that allows attackers to leak local file contents due to an error in the transformation feature.
Versions of phpMyAdmin prior to 4.8.4 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.5, indicating a medium severity level.
If immediate updates are not possible, consider implementing workarounds such as restricting access to phpMyAdmin and ensuring sensitive files are not publicly accessible.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
