phpMyAdmin

phpMyAdmin is intended to handle the administration of MySQL over the Web. Currently it can:

• Create and drop databases
• Create, copy, drop, and alter tables
• Delete, edit, and add fields
• Execute any SQL-statement, even batch-queries
• Manage keys on fields
• Load text files into tables
• Create and read dumps of tables
• Export data to CSV values
• Administer multiple servers and single databases

Note: While the software is classified as free, it is actually donationware. Please consider making a donation to help support development.

The security fixes involve:

• Arbitrary file read vulnerability
• SQL injection in the Designer interface
• The arbitrary file read vulnerability could also be exploited to delete arbitrary files on the server. This attack requires that phpMyAdmin be run with the $cfg['AllowArbitraryServer'] directive set to true, which is not the default. An attacker must run a malicious server process that will masquerade as a MySQL server. This exploit has been found and fixed recently in several other related projects and appears to be caused by a bug in PHP

In addition to the security fixes, this release also includes these bug fixes and more as part of our regular release cycle:

• Export to SQL format not available
• QR code not shown when adding two-factor authentication to a user account
• Issue with adding a new user in MySQL 8.0.11 and newer
• Frozen interface relating to Text_Plain_Sql plugin
• Table level Operations tab was missing