CVE-2008-1924

Name	CVE-2008-1924
Description	Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1557-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
phpmyadmin (PTS)	bullseye	4:5.0.4+dfsg2-2+deb11u1	fixed
	bookworm	4:5.2.1+dfsg-1	fixed
	trixie	4:5.2.2-really5.2.2+20241228+dfsg-1	fixed
	sid	4:5.2.2-really5.2.2+20250114+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
phpmyadmin	source	etch	4:2.9.1.1-7		DSA-1557-1
phpmyadmin	source	(unstable)	4:2.11.5.2-1

https://www.phpmyadmin.net/security/PMASA-2008-3/
https://github.com/phpmyadmin/phpmyadmin/commit/79fe2890d28076d9406f7032198109ecd22866a6