Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

phpMyAdmin GIS editor lets logged‑in users run any file

CVE-2014-8959 · published 11 years ago
Summary

The GIS editing feature in certain versions of phpMyAdmin can be tricked by a signed‑in user to load and execute any file on the server. This could let an attacker run malicious code or view sensitive data. Upgrade phpMyAdmin to the latest release or apply the vendor’s patch to stop the issue.

What to do
  • Update debian phpmyadmin to version 4:4.2.12-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian phpmyadmin < 4:4.2.12-1
Fix: upgrade to 4:4.2.12-1
Debian:13 debian phpmyadmin < 4:4.2.12-1
Fix: upgrade to 4:4.2.12-1
Debian:14 debian phpmyadmin < 4:4.2.12-1
Fix: upgrade to 4:4.2.12-1
– opensuse opensuse 12.3
13.1
13.2
cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
– phpmyadmin phpmyadmin 4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.4.1
4.0.4.2
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
42 more version ranges
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*
Original advisory text
Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenti...
Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files via a crafted geometry-type parameter.
References
Severity
6.5 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published30 Nov 2014
Updated30 Oct 2026
First seen1 Sep 2026
Sources
DEBIAN-CVE-2014-8959 · OSV
CVE-2014-8959 · NVD
Track software like this
Free during beta