The MIME transformation system (transformations/textplain_external.inc.php) in phpMyAdmin 2.5.0 up to 2.6.0-pl1 allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
{ "urgency": "not yet assigned" }