Skip to main content

phpMyAdmin Releases Critical Software Update - Patch Your Sites Now.

Developers of phpMyAdmin, one of the most popular and widely used MySQL database management systems, on 1 December 2018, released an updated version 4.8.4 of its software to patch several important vulnerabilities that could eventually allow remote attackers to take control of the affected web servers.


The phpMyAdmin project last Sunday gave an early heads up  about the latest security update through its blog, probably the first time, as an experiment to find if pre-announcements can help website admins, hosting providers and package managers better prepare for the security release.


"We are inspired by the workflow of other projects (such as Mediawiki and others) which often announce any security release in advance to allow package maintainers and hosting providers to prepare. We are experimenting to see if such a workflow is suitable for our project," phpMyAdmin release manager Isaac Bennetch told The Hacker News.


phpMyAdmin is a free, open-source administration tool for managing MySQL databases using a simple graphical interface over the web-browser.


Almost every web hosting service pre-installs phpMyAdmin with their control panels to help webmasters easily manage their databases for websites, including WordPress, Joomla, and many other content management platforms.


Besides many bug fixes, there are primarily three critical security vulnerabilities that affect phpMyAdmin versions before release 4.8.4, phpMyAdmin revealed in its latest advisory.


New phpMyAdmin Vulnerabilities.


Details of three newly discovered phpMyAdmin vulnerabilities are as described below:


1.) Local file inclusion (CVE-2018-19968) — phpMyAdmin versions from at least 4.0 through 4.8.3 includes a local file inclusion flaw that could allow a remote attacker to read sensitive contents from local files on the server through its transformation feature.


“The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.”


2.) Cross-Site Request Forgery (CSRF)/XSRF (CVE-2018-19969) —phpMyAdmin versions 4.7.0 through 4.7.6 and 4.8.0 through 4.8.3 includes a CSRF/XSRF flaw, which if exploited, could allow attackers to "perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes" just by convincing victims into opening specially crafted links.


3.) Cross-site scripting (XSS) (CVE-2018-19970) — The software also includes a cross-site scripting vulnerability in its navigation tree, which impacts versions from at least 4.0 through 4.8.3, using which an attacker can inject malicious code into the dashboard through a specially-crafted database/table name.


To address all above listed security vulnerabilities, phpMyAdmin developers today released the latest version 4.8.4, as well as separate patches for some previous versions.


Website administrators and hosting providers are highly recommended to install latest update or patches immediately.


Comments

Post a Comment

Popular posts from this blog

Ambassador Angualia Richard Perished in a Fatal Accident.

Story by Osuta Yusuf. Arua City. 29-7-2025. 📸: Portrait of Ambassador Angualia Richard. Courtesy Photo. Former Uganda's Ambassador to Egypt, Ambassador Angualia Louis Richard has been reported dead this evening 5pm 28-7-2025 after he was involved in a head-on collision accident with another motorcycle rider near Abi Farm, Ayivu East Constituency in Arua City. 📸: Photos from the scene of the Accident. Courtesy Photos. He met his death this evening while riding on a Bajaj Motorcycle. Amb. Angualia, who contested in 2011 for Maracha County but lost to Hon Alex Onzima Adrooa. In 2016 when two Constituencies were created in Maracha District, carving Maracha Constituency and Maracha East constituency, Ambassador Angualia contested for Maracha Constituency MP position in 2016 but lost to Hon Oguzu Lee Denis. Ambassador Angualia later shifted to contest in Maracha East Constituency but again lost to Hon Ruth Lematia Molly Ondoru during the 4-September-2020...
1 comment
Read more

Lab Student Drowned, Body Missing in Rokoze Lake in Nyadri Sub-county, Maracha District.

Maracha District.  5-December-2025. 📸: Residents gathered around the lake as they searched the missing body of the student. Photo by #Information_is_Power's news reporter.  This afternoon Friday 5-December-2025, a student from St Joseph Laboratory Training School in Maracha hospital, a one  Araku Denis drowned in Rokoze water body in Nyadri Sub-county and the  body has not been retrieved upto this night as the police and residents searched for it and in vain but they are expected to resume retrieving it tomorrow Saturday 6-December-2025. 📸: Photo of the deceased which we captured on his phone screen this night. Araku and his fellow students had  reportedly gone to pass time at water point after completing exams papers of today. Him and callagues got attracted to swimming at water body where he perished.  By press time, efforts to retrieve his body proved futile as the body remains invisible on water surface.  Rokoze water body...
Post a Comment
Read more

Hon Oguzu Lee Denis Drags to Court, Maracha Constituency MP-Elect Uhuru Nelson and Electoral Commission.

Story by Osuta Yusuf.  Maracha District 6-April-2026. Following the 15-1-2026 general election, the two term MP for Maracha Constituency, Hon Oguzu Lee Denis has dragged to court the Winner for Maracha Constituency MP election, Uhuru Nelson as the first respondent and Election Commission as the second respondent.  📸: Copy of the court document shared in NEWS PLATFORM, one of the WhatsApp groups in WestNile region. In a document dated 1-April-2026 filed at Arua High Court, it's not yet clear which grounds the petitioner, Hon Oguzu Lee Denis has used to challenge the victory of the NRM Party candidate Uhuru Nelson.  It should be noted that, the NRM Party candidate Uhuru Nelson was declared the winner of the 15-1-2026 general election after he garnered 13,696 votes, followed by Independent candidate Obeta Moses Drakua who garnered 9,247 votes, the incumbent MP Hon Oguzu Lee Denis (FDC) fell in the third position after he got 3,290 votes, Eng. Aguta Sam (Independent) got 686...
Post a Comment
Read more