phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sql_localfile parameter.

A phpMyAdmin security announcement reports :

File disclosure: on systems where the UploadDir mecanism is active, read_dump.php can be called with a crafted form; using the fact that the sql_localfile variable is not sanitized can lead to a file disclosure.

Enabling PHP safe mode on the server can be used as a workaround for this vulnerability.

The remote host is affected by the vulnerability described in GLSA-200412-19 (phpMyAdmin: Multiple vulnerabilities)

    Nicolas Gregoire (exaprobe.com) has discovered two vulnerabilities     that exist only on a webserver where PHP safe_mode is off. These     vulnerabilities could lead to command execution or file disclosure.
  Impact :

    On a system where external MIME-based transformations are enabled,     an attacker can insert offensive values in MySQL, which would start a     shell when the data is browsed. On a system where the UploadDir is     enabled, read_dump.php could use the unsanitized sql_localfile variable     to disclose a file.
  Workaround :

    You can temporarily enable PHP safe_mode or disable external     MIME-based transformation AND disable the UploadDir. But instead, we     strongly advise to update your version to 2.6.1_rc1.

The remote host is running phpMyAdmin, an open-source software written in PHP to handle the administration of MySQL over the Web.
The remote version of this software is vulnerable to arbitrary command execution due to a lack of user-supplied data sanitization.
In addition, the remote host is vulnerable to multiple remote Cross-Site Scripting (XSS) flaws. An attacker exploiting these flaws would need to be able to convince a user into clicking on a malicious URL.  Upon successful exploitation, the attacker would be able to steal credentials or execute code within the browser.
Thirdly, the remote host is vulnerable to a flaw in the way that it handles user-supplied variables that are used within included files.  An attacker exploiting this flaw would pass malicious data to the server that the server would then include within the executing script code.  A successful exploit would result in the attacker being able to execute arbitrary code on the server. 

According to its banner, the remote version of phpMyAdmin is vulnerable to one (or both) of the following flaws :

- An attacker may be able to exploit this software to execute arbitrary commands on the remote host on a server which does not run PHP in safe mode. 

- An attacker may be able to read arbitrary files on the remote host through the argument 'sql_localfile' of the file 'read_dump.php'.

ID	Name	Product	Family	Severity
19051	FreeBSD : phpmyadmin -- file disclosure vulnerability (9f0a405e-4edd-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
16006	GLSA-200412-19 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
2452	phpMyAdmin < 2.6.1-pl1 RCE	Nessus Network Monitor	CGI	high
15948	phpMyAdmin < 2.6.1-rc1 Multiple Remote Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2004-1148

high

Tenable Plugins

medium

critical

high

medium