Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

phpMyAdmin allows attackers to read sensitive files

CVE-2011-4107 · published 14 years ago
Summary

A security issue in phpMyAdmin allows attackers who are logged in to your system to read any file on the server. This is a problem because it could let an attacker see sensitive information that they shouldn't have access to. To fix this, update phpMyAdmin to the latest version or remove the XML import plug-in.

What to do
  • Update phpmyadmin phpmyadmin to version 3.4.7.1.
  • Update phpmyadmin phpmyadmin to version 3.3.10.5.
  • Update debian phpmyadmin to version 4:3.4.7.1-1.
Affected software
Ecosystem VendorProductAffected versions
composer phpmyadmin phpmyadmin >= 3.4.0, < 3.4.7.1
>= 3.3.0, < 3.3.10.5
Fix: upgrade to 3.4.7.1
– phpmyadmin phpmyadmin >= 3.3.0.0, < 3.3.10.5
>= 3.4.0.0, < 3.4.7.1
cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*
– fedoraproject fedora 14
15
16
cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*
– debian debian_linux 5.0
cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
Debian:11 debian phpmyadmin < 4:3.4.7.1-1
Fix: upgrade to 4:3.4.7.1-1
Debian:12 debian phpmyadmin < 4:3.4.7.1-1
Fix: upgrade to 4:3.4.7.1-1
Debian:13 debian phpmyadmin < 4:3.4.7.1-1
Fix: upgrade to 4:3.4.7.1-1
Debian:14 debian phpmyadmin < 4:3.4.7.1-1
Fix: upgrade to 4:3.4.7.1-1
Original advisory text
The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitr...
The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
13% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-611XML External Entity (XXE)
Timeline
Published17 Nov 2011
Updated22 Oct 2026
First seen6 Mar 2026
Sources
GHSA-q4mm-89q2-xffg · GHSA
CVE-2011-4107 · NVD
DEBIAN-CVE-2011-4107 · OSV
Track software like this
Free during beta