Description

Directory traversal vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to read arbitrary files via directory traversal sequences in the file_path parameter ($filename variable).

Remediation

References

CVE-2009-1148

Related Vulnerabilities

Drupal Improper Removal of Sensitive Information Before Storage or Transfer Vulnerability (CVE-2022-31042)

phpMyAdmin Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2009-1151)

Plone CMS Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-7317)

Plone CMS Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-33926)

WordPress Ultimate Member Plugin Improper Privilege Management Vulnerability (CVE-2020-36156)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-22 CVE-2009-1148