Quote:phpMyAdmin security announcement PMASA-2008-7

Announcement-ID: PMASA-2008-7
Date: 2008-09-15
Updated: 2008-09-17 (CVE id)

Summary:
Code execution vulnerability

Description:
We received an advisory from Norman Hippert and we wish to thank him for his work. The server_databases.php script was vulnerable to an attack coming from a user who is already logged-on to phpMyAdmin, where he can execute shell code (if the PHP configuration permits commands like exec).

Severity:
We consider this vulnerability to be serious.

Affected versions:
Versions before 2.11.9.1.

Solution:
Upgrade to phpMyAdmin 2.11.9.1 or newer.
References:

http://fd.the-wildcat.de/pma_e36a091q11.php
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4096
In case of questions, please contact the phpMyAdmin team. Our website is http://www.phpmyadmin.net/.