GHSA-gmc7-jvv7-w245high8.0
phpMyAdmin allows remote attackers to bypass authentication and obtain sensitive information
Impact
phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
phpmyadmin/phpmyadmin Packagist
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 3.4.0-beta1Ecosystem versions | 3.4.0-beta1 |
Version evidence: OSV · GHSA-gmc7-jvv7-w245
View original version evidence (0 explicit versions)
Original source description
phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2010-4481
- Source reference github.com/phpmyadmin/phpmyadmin
- Source reference phpmyadmin.git.sourceforge.net/git/gitweb.cgi
- Source reference phpmyadmin.git.sourceforge.net/git/gitweb.cgi
- Security advisory www.debian.org/security/2010/dsa-2139
- Security advisory www.mandriva.com/security/advisories
- Security advisory www.phpmyadmin.net/home_page/security/PMASA-2010-10.php