CVE-2012-4219 (Other, published 2012-08-21T19:55Z)
Description: value: show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message, related to lack of inclusion of the common.inc.php library file.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
show_config_errors.php
Commit message: - [security] Fixed local path disclosure vulnerability


Vulnerable code:
- bug #3482734 [interface] No warning on syntax error in search form 
- bug #3504567 [mime] Description of the transformation missing in the tooltip 
- bug #3410604 [config] Configuration storage incorrect suggested table name 
- [security] Fixed XSS with db/table/column names, see PMASA-2011-14 
+ rfe #2890226 [view] Enable VIEW rename 
+ rfe #838637 [privileges] Export a user's privileges 
+ rfe #854911  [interface] Grey out non applicable actions in structure 
+ [lang] Chinese Simplified update, thanks to Shanyan Baishui - rimyxp 
+ patch #2974341 [structure] Clicking on table name in db Structure should 
+ patch #2981165 [edit] Optionally disable the Type column, 
+ rfe #2988629 [relation] Improve labels in relation view 
- patch #3025161 [core] Prevent sending of unnecessary cookies, 
- patch #3038312 [export] JSON export, 
+ [interface] AJAXification on various pages 
- bug #3056610 [interface] Removed modification options for information_schema 
+ rfe #3141330 [relation] When displaying results, show a link to the foreign 
  thanks to Madhura Jayaratne - madhuracj 
- bug #3153409 [core] 0 row(s) affected 

Fixed code:
3.5.2.1 (not yet released)
- [security] Fixed local path disclosure vulnerability, see PMASA-2012-3

- bug #3482734 [interface] No warning on syntax error in search form
- bug #3504567 [mime] Description of the transformation missing in the tooltip
- bug #3410604 [config] Configuration storage incorrect suggested table name
- [security] Fixed XSS with db/table/column names, see PMASA-2011-14
+ rfe #2890226 [view] Enable VIEW rename
+ rfe #838637 [privileges] Export a user's privileges
+ rfe #854911  [interface] Grey out non applicable actions in structure
+ [lang] Chinese Simplified update, thanks to Shanyan Baishui - rimyxp
+ patch #2974341 [structure] Clicking on table name in db Structure should
+ patch #2981165 [edit] Optionally disable the Type column,
+ rfe #2988629 [relation] Improve labels in relation view
- patch #3025161 [core] Prevent sending of unnecessary cookies,
- patch #3038312 [export] JSON export,
+ [interface] AJAXification on various pages
- bug #3056610 [interface] Removed modification options for information_schema
+ rfe #3141330 [relation] When displaying results, show a link to the foreign
  thanks to Madhura Jayaratne - madhuracj
- bug #3153409 [core] 0 row(s) affected
// we need the common loader for the PMA_no_cache_header function
define('PMA_MINIMUM_COMMON', 1);
require './libraries/common.inc.php';