CWE Code: 200
Vulnerability Type: sql_injection
CVSS Score: 4.3
CWE Name:  Information Exposure
Summary: an issue was discovered in phpmyadmin before 4.8.5. when the allowarbitraryserver configuration setting is set to true, with the use of a rogue mysql server, an attacker can read any file on the server that the web server's user can access. this is related to the mysql.allow_local_infile php configuration, and the inadvertent ignoring of "options(mysqli_opt_local_infile" calls.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2019-01-26
Last Modified Date: 2019-02-28