CVE-2004-2631
Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is...
Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name.
Exploit likelihood
What each source reports
NVD Score used
Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name.
- Record
CVE-2004-2631- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name.
- Record
CVE-2004-2631- Updated
- 2026-11-02
EUVDEUVD-2004-2622 No score
Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name.
- Record
EUVD-2004-2622- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qqgf-6922-rxxc No score
Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is...
Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name.
- Record
GHSA-qqgf-6922-rxxc- Updated
- 2026-11-02
OSV No score
Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name.
- Record
CVE-2004-2631- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-2631 No score
Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name.
- Record
DEBIAN-CVE-2004-2631- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadminDebian:12 |
before 1:2.5.7-pl1-1 | 1:2.5.7-pl1-1 |
phpmyadminDebian:13 |
before 1:2.5.7-pl1-1 | 1:2.5.7-pl1-1 |
phpmyadminDebian:14 |
before 1:2.5.7-pl1-1 | 1:2.5.7-pl1-1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | phpMyAdmin 2.5.7 - Remote code Injection | 2004-07-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-2631 is a high vulnerability (CVSS 7.5) in Phpmyadmin, published December 31, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.35%, the 95th percentile. Fixed in phpmyadmin 1:2.5.7-pl1-1.
References
archives.neohapsis.com/archives/bugtraq/2004-06/0473.html
osvdb.org/7314
phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1
secunia.com/advisories/11974
exchange.xforce.ibmcloud.com/vulnerabilities/16542
Show 9 moreShow less
securiteam.com/unixfocus/5QP040ADFW.html
marc.info?l=bugtraq&m=109816584519779&w=2
securityfocus.com/bid/10629
securitytracker.com/id?1010614
gentoo.org/security/en/glsa/glsa-200407-22.xml
eagle.kecapi.com/sec/fd/phpMyAdmin.html
nvd.nist.gov/vuln/detail/CVE-2004-2631
github.com/advisories/GHSA-qqgf-6922-rxxc
security-tracker.debian.org/tracker/CVE-2004-2631