phpMyAdmin Releases Critical Software Update — Patch Your Sites Now!

Developers of phpMyAdmin, one of the most popular and widely
used MySQL database management systems, today released an updated
version 4.8.4 of its software to patch several important
vulnerabilities that could eventually allow remote attackers to
take control of the affected web servers.

The phpMyAdmin project Sunday gave an early
heads-up^[1] about the latest
security release on its blog, informing website administrators
about this significant update.

phpMyAdmin is a free, open-source administration tool for
managing MySQL databases using a simple graphical interface over
the web-browser.

Almost every web hosting service pre-installs phpMyAdmin with
their control panels to help webmasters easily manage their
databases for websites, including WordPress, Joomla, and many other
content management platforms.

Besides many bug fixes, there are primarily three critical security
vulnerabilities that affect phpMyAdmin versions before release
4.8.4, phpMyAdmin revealed in its latest advisory.

Details of three newly discovered^[2]
phpMyAdmin vulnerabilities are as described below:

1.) Local file inclusion (CVE-2018-19968) — phpMyAdmin
versions from at least 4.0 through 4.8.3 includes a local file
inclusion flaw that could allow a remote attacker to read sensitive
contents from local files on the server through its transformation
feature.

“The attacker must have access to the phpMyAdmin Configuration
Storage tables, although these can easily be created in any
database to which the attacker has access. An attacker must have
valid credentials to log in to phpMyAdmin; this vulnerability does
not allow an attacker to circumvent the login system.”

2.) Cross-Site Request Forgery (CSRF)/XSRF (CVE-2018-19969)
— phpMyAdmin versions 4.7.0 through 4.7.6 and 4.8.0 through
4.8.3 includes CSRF/XSRF flaw that could allow attackers to
“perform harmful SQL operations such as renaming databases,
creating new tables/routines, deleting designer pages,
adding/deleting users, updating user passwords, killing SQL
processes, etc.” just by convincing victims into opening specially
crafted links.

3.) Cross-site scripting (XSS) (CVE-2018-19970) — The
software also includes a cross-site scripting vulnerability in its
navigation tree, using which an attacker can inject malicious code
through a specially-crafted database/table name.

Since phpMyAdmin has now released its latest version 4.8.4 to
address all reported flaws, website administrators and hosting
providers are highly recommended to install the update
immediately.