Announcement-ID: PMASA-2008-3
Date: 2008-04-22
Updated: 2008-04-27
File disclosure on shared hosts via a crafted HTTP POST request.
We received an advisory from Cezary Tomczak, and we wish to thank him for his work. It is possible to read the contents of any file that the web server's user can access. The exact mechanism to achieve this won't be disclosed.
We consider this vulnerability to be serious.
Versions before 2.11.5.2.
Upgrade to phpMyAdmin 2.11.5.2 or newer.
Assigned CVE ids: CVE-2008-1924
For further information and in case of questions, please contact the phpMyAdmin team. Our website is http://www.phpmyadmin.net.