Description
phpMyAdmin 2.7.0-beta1 and earlier allows remote attackers to obtain the full path of the server via direct requests to multiple scripts in the libraries directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phpmyadmin | No fix yet | — |
| Debian 13 | phpmyadmin | No fix yet | — |
| Debian 12 | phpmyadmin | No fix yet | — |
References
- 20051115 [FS-05-02] Multiple vulnerabilities in phpMyAdmin mailing-list
- 185 third-party-advisory
- 20914 vdb-entry
- 20912 vdb-entry
- 1015213 vdb-entry
- http://www.fitsec.com/advisories/FS-05-02.txt
- 20911 vdb-entry
- 20913 vdb-entry