CVE-2008-1924: Infoleak
Published Apr 23, 2008
·Updated
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
Affected Software
24 affected components
phpMyAdmin phpMyAdmin<=2.11.5.1
phpMyAdmin phpMyAdmin=2.10.0
phpMyAdmin phpMyAdmin=2.10.0.1
phpMyAdmin phpMyAdmin=2.10.0.2
phpMyAdmin phpMyAdmin=2.10.1
phpMyAdmin phpMyAdmin=2.10.2
phpMyAdmin phpMyAdmin=2.10.3
phpMyAdmin phpMyAdmin=2.10.3rc1
phpMyAdmin phpMyAdmin=2.11.0
phpMyAdmin phpMyAdmin=2.11.0beta1
phpMyAdmin phpMyAdmin=2.11.0rc1
phpMyAdmin phpMyAdmin=2.11.1
phpMyAdmin phpMyAdmin=2.11.1.1
phpMyAdmin phpMyAdmin=2.11.1.2
phpMyAdmin phpMyAdmin=2.11.1rc1
phpMyAdmin phpMyAdmin=2.11.2
phpMyAdmin phpMyAdmin=2.11.2.1
phpMyAdmin phpMyAdmin=2.11.2.2
phpMyAdmin phpMyAdmin=2.11.3
phpMyAdmin phpMyAdmin=2.11.3rc1
phpMyAdmin phpMyAdmin=2.11.4
phpMyAdmin phpMyAdmin=2.11.4rc1
phpMyAdmin phpMyAdmin=2.11.5
phpMyAdmin phpMyAdmin=2.11.6rc1
Remediation
Patch Available
Event History
Apr 23, 2008
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-1924?
CVE-2008-1924 is considered to have a high severity level as it allows remote authenticated users to read arbitrary files on the server.
2
How do I fix CVE-2008-1924?
To fix CVE-2008-1924, upgrade phpMyAdmin to version 2.11.5.2 or later.
3
Which versions of phpMyAdmin are affected by CVE-2008-1924?
CVE-2008-1924 affects phpMyAdmin versions prior to 2.11.5.2, including multiple earlier versions.
4
What type of vulnerability is CVE-2008-1924?
CVE-2008-1924 is a file inclusion vulnerability that allows unauthorized file access.
5
Can CVE-2008-1924 be exploited on shared hosting environments?
Yes, CVE-2008-1924 can be exploited on shared hosting environments where phpMyAdmin is deployed.