CVE-2019-6799: SQL Injection
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allowlocalinfile PHP configuration, and the inadvertent ignoring of "options(MYSQLIOPTLOCALINFILE" calls.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-6799?
The severity of CVE-2019-6799 is medium.
How does CVE-2019-6799 affect phpMyAdmin?
CVE-2019-6799 allows an attacker to read any file on the server that the web server's user can access.
What is the affected software for CVE-2019-6799?
The affected software for CVE-2019-6799 is phpMyAdmin versions before 4.8.5 and Debian Linux 8.0.
How can I fix CVE-2019-6799?
To fix CVE-2019-6799, update phpMyAdmin to version 4.8.5 or above and apply the necessary security patches for Debian Linux.
Where can I find more information about CVE-2019-6799?
You can find more information about CVE-2019-6799 at the following references: http://www.securityfocus.com/bid/106736, https://lists.debian.org/debian-lts-announce/2019/02/msg00039.html, https://www.phpmyadmin.net/security/PMASA-2019-1/