CVE-2019-6799

An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allowlocalinfile PHP configuration, and the inadvertent ignoring of "options(MYSQLIOPTLOCAL_INFILE" calls.

References

Affected packages

Git / github.com/phpmyadmin/phpmyadmin

Affected ranges

Type

GIT

Repo

https://github.com/phpmyadmin/phpmyadmin

Events

Introduced

6da64cc3b2ba4439574f914f51e161645375be96

Last affected

56ba19808f020fa8ac63366d450c3928564a91b8

Database specific

{
    "versions": [
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.8.4"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-6799.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0"
            }
        ]
    }
]