Critical File Access Vulnerability in phpMyAdmin: CVE-2019-6799
Summary
UBUNTU-CVE-2019-6799: An issue was discovered in phpMyAdmin before 4.8.5. Affects phpmyadmin versions 4:4.0.10-1 – 4:4.0.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely used open-source tool for managing MySQL databases through a web interface. It allows users to perform various database operations such as creating, modifying, and deleting databases and tables. The tool is known for its user-friendly interface and extensive features, making it a popular choice among developers and database administrators. However, certain configurations can expose it to vulnerabilities, such as the one identified in CVE-2019-6799, which can lead to unauthorized file access on the server.
Vulnerability Detail
CVE-2019-6799 is a vulnerability found in phpMyAdmin versions prior to 4.8.5. It arises when the AllowArbitraryServer configuration setting is enabled, allowing an attacker to exploit a rogue MySQL server to read any file accessible to the web server's user. This vulnerability is linked to the mysql.allow_local_infile PHP configuration and the improper handling of MYSQLI_OPT_LOCAL_INFILE options, potentially leading to significant data exposure.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable the AllowArbitraryServer setting in your phpMyAdmin configuration file to prevent unauthorized access. This can be done by setting the following line in your config.inc.php file: $cfg['Servers'][$i]['AllowArbitraryServer'] = false;
Conclusion
CVE-2019-6799 represents a significant security risk for phpMyAdmin users, particularly those with the AllowArbitraryServer setting enabled. It is crucial to update to the latest version to mitigate this vulnerability and protect sensitive data from unauthorized access.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2019-6799 is a vulnerability in phpMyAdmin that allows unauthorized file access when certain configurations are enabled.
If you are using a version of phpMyAdmin prior to 4.8.5 and have the AllowArbitraryServer setting enabled, your installation is vulnerable.
An attacker could potentially read sensitive files on the server, leading to data breaches and unauthorized access to critical information.
Yes, upgrading to phpMyAdmin version 4.8.5 or later will patch this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for vulnerabilities without any signup at the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
