libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
{
"versions": [
{
"introduced": "0"
},
{
"last_affected": "4.5.0"
},
{
"introduced": "0"
},
{
"last_affected": "4.5.0.1"
},
{
"introduced": "0"
},
{
"last_affected": "4.5.0.2"
},
{
"introduced": "0"
},
{
"last_affected": "4.5.1"
},
{
"introduced": "0"
},
{
"last_affected": "4.5.2"
},
{
"introduced": "0"
},
{
"last_affected": "4.5.3"
}
]
}