CVE-2018-19968

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.8.4

Description The issue allows an attacker to leak the contents of a local file due to an error in the transformation feature. To exploit this, the attacker must have access to the phpMyAdmin Configuration Storage tables, which can be created in any database the attacker has access to. The attacker must also have valid credentials to log in to phpMyAdmin, as this issue does not bypass the login system.

Recommendations For versions prior to 4.8.4, update to version 4.8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the phpMyAdmin Configuration Storage tables to minimize the risk of exploitation.