Description
One server from the SourceForge.net mirror system was distributing a phpMyAdmin kit containing a backdoor. One of the SourceForge.net mirrors, namely cdnetworks-kr-1, was being used to distribute a modified archive of phpMyAdmin, which includes a backdoor. This backdoor is located in file server_sync.php and allows an attacker to remotely execute PHP code. Another file, js/cross_framing_protection.js, has also been modified. We currently know only about phpMyAdmin-3.5.2.2-all-languages.zip being affected, check if your download contains a file named server_sync.php.
Remediation
Check your phpMyAdmin distribution and download it again from a trusted mirror if your copy contains a file named server_sync.php.
References
Related Vulnerabilities
Juniper Junos OS J-Web RCE (CVE-2023-36845/CVE-2023-36846)
Apache Log4j2 JNDI Remote Code Execution
WordPress Plugin Yoast SEO Possible Remote Code Execution (9.1.0)
WordPress Plugin Import XML and RSS Feeds Remote Code Execution (2.1.4)
Apache HTTP Server Insecure Path Normalization (CVE-2021-41773, CVE-2021-42013)