Description
phpMyAdmin 2.5.1 up to 2.5.7 allows remote attackers to modify configuration settings and gain unauthorized access to MySQL servers via modified $cfg['Servers'] variables.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phpmyadmin | 1:2.5.7-pl1-1 | — |
| Debian 13 | phpmyadmin | 1:2.5.7-pl1-1 | — |
| Debian 12 | phpmyadmin | 1:2.5.7-pl1-1 | — |
References
- 20040630 Re: php codes injection in phpMyAdmin version 2.5.7. mailing-list
- http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1
- 11974 third-party-advisory
- 20040628 php codes injection in phpMyAdmin version 2.5.7. mailing-list
- 7315 vdb-entry
- 10629 vdb-entry
- 1010614 vdb-entry
- GLSA-200407-22 vendor-advisory
- http://eagle.kecapi.com/sec/fd/phpMyAdmin.html
- phpmyadmin-code-manipulation(16555) vdb-entry