CVE-2008-1924
published 2008-04-23CVE-2008-1924: Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read…
PriorityP419low3.5CVSS 2.0
AVNACMAuSCPINAN
EPSS
1.63%
73.7th percentile
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | phpmyadmin | < phpmyadmin 4:2.11.5.2-1 (bookworm) | phpmyadmin 4:2.11.5.2-1 (bookworm) |
| phpmyadmin | phpmyadmin | <= 2.11.5.1 | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
CVSS provenance
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:P/I:N/A:N
osv3.5LOW
vendor_debian3.5LOW
vendor_redhat3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pfxq-3wfw-4c7m: Unspecified vulnerability in phpMyAdmin before 2
ghsa_unreviewed·2022-05-01
CVE-2008-1924 [LOW] CWE-200 GHSA-pfxq-3wfw-4c7m: Unspecified vulnerability in phpMyAdmin before 2
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
OSV
CVE-2008-1924: Unspecified vulnerability in phpMyAdmin before 2
osv·2008-04-23·CVSS 3.5
CVE-2008-1924 [LOW] CVE-2008-1924: Unspecified vulnerability in phpMyAdmin before 2
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
Debian
CVE-2008-1924: phpmyadmin - Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared ...
vendor_debian·2008·CVSS 3.5
CVE-2008-1924 [LOW] CVE-2008-1924: phpmyadmin - Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared ...
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
Scope: local
bookworm: resolved (fixed in 4:2.11.5.2-1)
bullseye: resolved (fixed in 4:2.11.5.2-1)
forky: resolved (fixed in 4:2.11.5.2-1)
sid: resolved (fixed in 4:2.11.5.2-1)
trixie: resolved (fixed in 4:2.11.5.2-1)
Red Hat
phpMyAdmin: Permission/information leak to access with apache rights
vendor_redhat·CVSS 3.5
CVE-2008-1924 [LOW] phpMyAdmin: Permission/information leak to access with apache rights
phpMyAdmin: Permission/information leak to access with apache rights
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.htmlhttp://secunia.com/advisories/29944http://secunia.com/advisories/29964http://secunia.com/advisories/30034http://secunia.com/advisories/30816http://secunia.com/advisories/32834http://secunia.com/advisories/33822http://security.gentoo.org/glsa/glsa-200805-02.xmlhttp://www.debian.org/security/2008/dsa-1557http://www.mandriva.com/security/advisories?name=MDVSA-2008:131http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3http://www.securityfocus.com/bid/28906http://www.vupen.com/english/advisories/2008/1328/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/41964http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.htmlhttp://secunia.com/advisories/29944http://secunia.com/advisories/29964http://secunia.com/advisories/30034http://secunia.com/advisories/30816http://secunia.com/advisories/32834http://secunia.com/advisories/33822http://security.gentoo.org/glsa/glsa-200805-02.xmlhttp://www.debian.org/security/2008/dsa-1557http://www.mandriva.com/security/advisories?name=MDVSA-2008:131http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3http://www.securityfocus.com/bid/28906http://www.vupen.com/english/advisories/2008/1328/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/41964
2008-04-23
Published