Code execution vulnerability
We received an advisory from Norman Hippert and we wish to thank him for his work. The server_databases.php script was vulnerable to an attack coming from a user who is already logged-on to phpMyAdmin, where he can execute shell code (if the PHP configuration permits commands like exec).
We consider this vulnerability to be serious.
Versions before 22.214.171.124.
Upgrade to phpMyAdmin 126.96.36.199 or newer.
Maintainers, please bump.
libraries/database_interface.lib.php in phpMyAdmin before 188.8.131.52
allows remote authenticated users to execute arbitrary code via a
request to server_databases.php with a sort_by parameter containing
PHP sequences, which are processed by create_function.
Maintainers, please bump. We have a target delay of 5 days for B1 issues.
phpmyadmin-184.108.40.206 is in the tree. Sorry for the delay.
Arches, please test and mark stable:
Target keywords : "alpha amd64 hppa ppc ppc64 sparc x86"
Stable for HPPA.
All arches done, request filed.
Removed phpmyadmin-2.11.8, -220.127.116.11. webapps done