PMA Security vulnerability ?

[joximu]

@RatS:
the blowfish_secret has nothing to do with the access to the database - it's just the encryption key for the cookie session. If the session has expired then you must login in any case - during the session it's ok if you have the crypted cookies in the browser...
I changed the blowfishsecret and all I had to do is login again into pma...

That's why I thought that if I have the cookies from BeNe I could try to get the passwords (no need to be on the same day) and then I get maybe the login infor for his pma...
(I have the key - is default -> I should be able to decrypt the cookie session data.

Or am I totally wrong...??

Cheers