phpMyAdmin CVE-2018-19968 Local File Include Vulnerability

Bugtraq ID:	106178
Class:	Design Error
CVE:	CVE-2018-19968
Remote:	Yes
Local:	No
Published:	Dec 07 2018 12:00AM
Updated:	Dec 12 2018 12:00PM
Credit:	Daniel Le Gall from SCRT
Vulnerable:	phpMyAdmin phpMyAdmin 4.8.3 phpMyAdmin phpMyAdmin 4.8.2 phpMyAdmin phpMyAdmin 4.8.1 phpMyAdmin phpMyAdmin 4.8 phpMyAdmin phpMyAdmin 4.7.8 phpMyAdmin phpMyAdmin 4.7.7 phpMyAdmin phpMyAdmin 4.7.6 phpMyAdmin phpMyAdmin 4.7.5 phpMyAdmin phpMyAdmin 4.7.4 phpMyAdmin phpMyAdmin 4.7.3 phpMyAdmin phpMyAdmin 4.7.2 phpMyAdmin phpMyAdmin 4.7.1 phpMyAdmin phpMyAdmin 4.7 phpMyAdmin phpMyAdmin 4.6 phpMyAdmin phpMyAdmin 4.5.4 phpMyAdmin phpMyAdmin 4.5.2 phpMyAdmin phpMyAdmin 4.4.10 phpMyAdmin phpMyAdmin 4.4.9 phpMyAdmin phpMyAdmin 4.4.8 phpMyAdmin phpMyAdmin 4.4.7 phpMyAdmin phpMyAdmin 4.4.6 phpMyAdmin phpMyAdmin 4.4.5 phpMyAdmin phpMyAdmin 4.4.3 phpMyAdmin phpMyAdmin 4.4.2 phpMyAdmin phpMyAdmin 4.4.1 phpMyAdmin phpMyAdmin 4.4 phpMyAdmin phpMyAdmin 4.3.10 phpMyAdmin phpMyAdmin 4.2.8 phpMyAdmin phpMyAdmin 4.2.6 phpMyAdmin phpMyAdmin 4.2.5 phpMyAdmin phpMyAdmin 4.2.4 phpMyAdmin phpMyAdmin 4.2.3 phpMyAdmin phpMyAdmin 4.2.2 phpMyAdmin phpMyAdmin 4.2.1 phpMyAdmin phpMyAdmin 4.2 phpMyAdmin phpMyAdmin 4.1.10 phpMyAdmin phpMyAdmin 4.1.9 phpMyAdmin phpMyAdmin 4.1.7 phpMyAdmin phpMyAdmin 4.1.6 phpMyAdmin phpMyAdmin 4.1.1 phpMyAdmin phpMyAdmin 4.1 phpMyAdmin phpMyAdmin 4.0.5 phpMyAdmin phpMyAdmin 4.0.4 phpMyAdmin phpMyAdmin 4.0.3 phpMyAdmin phpMyAdmin 4.0.2 phpMyAdmin phpMyAdmin 4.0.1 phpMyAdmin phpMyAdmin 4.0 phpMyAdmin phpMyAdmin 4.5.5.0 phpMyAdmin phpMyAdmin 4.5.3.0 phpMyAdmin phpMyAdmin 4.5.1 phpMyAdmin phpMyAdmin 4.5.0 phpMyAdmin phpMyAdmin 4.3.9 phpMyAdmin phpMyAdmin 4.3.8 phpMyAdmin phpMyAdmin 4.3.7 phpMyAdmin phpMyAdmin 4.3.6 phpMyAdmin phpMyAdmin 4.3.5 phpMyAdmin phpMyAdmin 4.3.4 phpMyAdmin phpMyAdmin 4.3.3 phpMyAdmin phpMyAdmin 4.3.2 phpMyAdmin phpMyAdmin 4.3.1 phpMyAdmin phpMyAdmin 4.3.0 phpMyAdmin phpMyAdmin 4.2.7 phpMyAdmin phpMyAdmin 4.1.8 phpMyAdmin phpMyAdmin 4.1.5 phpMyAdmin phpMyAdmin 4.1.4 phpMyAdmin phpMyAdmin 4.1.3 phpMyAdmin phpMyAdmin 4.1.2 phpMyAdmin phpMyAdmin 4.0.9 phpMyAdmin phpMyAdmin 4.0.8 phpMyAdmin phpMyAdmin 4.0.7 phpMyAdmin phpMyAdmin 4.0.6
Not Vulnerable:	phpMyAdmin phpMyAdmin 4.8.4

phpMyAdmin CVE-2018-19968 Local File Include Vulnerability

phpMyAdmin is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.


An attacker can exploit this issue to obtain potentially sensitive information and execute arbitrary local scripts. This could allow the attacker to compromise the application and the computer; other attacks are also possible.

The following phpMyAdmin versions are vulnerable:

4.0 through 4.8.3

phpMyAdmin CVE-2018-19968 Local File Include Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

phpMyAdmin CVE-2018-19968 Local File Include Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

phpMyAdmin CVE-2018-19968 Local File Include Vulnerability

References:

• phpMyAdmin Homepage (phpMyAdmin)
  
• PMASA-2018-6 (phpMyAdmin)