Description
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phpmyadmin | 4:4.5.1-1 | — |
| Debian 13 | phpmyadmin | 4:4.5.1-1 | — |
| Debian 12 | phpmyadmin | 4:4.5.1-1 | — |
| Debian 8 | phpmyadmin | 4:4.2.12-2+deb8u1 | DSA-3382-1 |
| Debian 7 | phpmyadmin | 4:3.4.11.1-2+deb7u2 | DSA-3382-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | phpMyAdmin | 4.6.5.2-1.1 | openSUSE-SU-2024:10054-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpmyadmin/phpmyadmin | >= 4.4.0, < 4.4.15.1 | 4.4.15.1 | GHSA-5pmg-qh2c-7j24 |
| Packagist | phpmyadmin/phpmyadmin | >= 4.5.0, < 4.5.1 | 4.5.1 | GHSA-5pmg-qh2c-7j24 |
Advisories 2
- DSA-3382-1 phpmyadmin - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10054-1 phpMyAdmin-4.6.5.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/phpmyadmin/phpmyadmin/commit/cd097656758f981f80fb9029c7d6b4294582b706
- https://www.phpmyadmin.net/security/PMASA-2015-5/
- DSA-3382 vendor-advisory
- FEDORA-2015-5c06260c4b vendor-advisory
- 1034013 vdb-entry
- FEDORA-2015-287c164df5 vendor-advisory
- 77299 vdb-entry
- FEDORA-2015-17908c56c1 vendor-advisory