Description
Multiple PHP remote file inclusion vulnerabilities in phpMyAdmin 2.6.1 allow remote attackers to execute arbitrary PHP code by modifying the (1) theme parameter to phpmyadmin.css.php or (2) cfg[Server][extension] parameter to database_interface.lib.php to reference a URL on a remote web server that contains the code.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phpmyadmin | 3:2.6.1-pl2-1 | — |
| Debian 13 | phpmyadmin | 3:2.6.1-pl2-1 | — |
| Debian 12 | phpmyadmin | 3:2.6.1-pl2-1 | — |
References
- phpmyadmin-file-include(19465) vdb-entry
- 14382 third-party-advisory
- 12645 vdb-entry
- http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1
- http://sourceforge.net/tracker/index.php?func=detail&aid=1149381&group_id=23067&atid=377408
- 20050224 [SECURITYREASON.COM] phpMyAdmin 2.6.1 Remote file inclusion and XSS cXIb8O3.4 mailing-list