First published: Wed Dec 15 2004(Updated: )
phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sql_localfile parameter.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
PhpMyAdmin | =2.4.0 | |
PhpMyAdmin | =2.5.0 | |
PhpMyAdmin | =2.5.1 | |
PhpMyAdmin | =2.5.2 | |
PhpMyAdmin | =2.5.4 | |
PhpMyAdmin | =2.5.5 | |
PhpMyAdmin | =2.5.5_pl1 | |
PhpMyAdmin | =2.5.5_rc1 | |
PhpMyAdmin | =2.5.5_rc2 | |
PhpMyAdmin | =2.5.6_rc1 | |
PhpMyAdmin | =2.5.7 | |
PhpMyAdmin | =2.5.7_pl1 | |
PhpMyAdmin | =2.6.0_pl1 | |
PhpMyAdmin | =2.6.0_pl2 | |
PhpMyAdmin | =2.6.0_pl3 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2004-1148 is classified as a medium-severity vulnerability.
To mitigate CVE-2004-1148, upgrade phpMyAdmin to version 2.6.1 or later.
CVE-2004-1148 affects phpMyAdmin versions prior to 2.6.1.
CVE-2004-1148 is a file inclusion vulnerability that allows remote attackers to read arbitrary files.
Yes, CVE-2004-1148 can be exploited remotely without user authentication.