|Category:||Web application abuses|
|Title:||phpMyAdmin 4.x < 4.8.4 Multiple Vulnerabilities - PMASA-2018-6, PMASA-2018-8 (Windows)|
|Summary:||phpMyAdmin is prone to multiple security vulnerabilities.|
phpMyAdmin is prone to multiple security vulnerabilities.
- A flaw has been found where an attacker can exploit phpMyAdmin to
leak the contents of a local file. The attacker must have access to the phpMyAdmin Configuration Storage
tables, although these can easily be created in any database to which the attacker has access. An attacker
must have valid credentials to log in to phpMyAdmin. This vulnerability does not allow an attacker to
circumvent the login system (CVE-2018-19968).
- A Cross-Site Scripting vulnerability was found in the navigation tree, where an attacker can deliver a
payload to a user through a specially-crafted database/table name (CVE-2018-19970).
phpMyAdmin versions from at least 4.0 through 4.8.3.
Update to version 4.8.4 or later.
Common Vulnerability Exposure (CVE) ID: CVE-2018-19968|
Common Vulnerability Exposure (CVE) ID: CVE-2018-19970
|Copyright||Copyright (C) 2018 Greenbone Networks GmbH|
|This is only one of 71225 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.