CVE-2008-1924
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows...
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
Exploit likelihood
What each source reports
NVD Score used
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
- Record
CVE-2008-1924- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
- Record
CVE-2008-1924- Updated
- 2026-11-02
EUVDEUVD-2008-1924 No score
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
- Record
EUVD-2008-1924- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pfxq-3wfw-4c7m No score
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows...
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
- Record
GHSA-pfxq-3wfw-4c7m- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
- Record
CVE-2008-1924- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-1924 No score
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
- Record
DEBIAN-CVE-2008-1924- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadminDebian:12 |
before 4:2.11.5.2-1 | 4:2.11.5.2-1 |
phpmyadminDebian:13 |
before 4:2.11.5.2-1 | 4:2.11.5.2-1 |
phpmyadminDebian:14 |
before 4:2.11.5.2-1 | 4:2.11.5.2-1 |
phpmyadminDebian:4.0 From an advisory covering 3 CVEs |
before 4:2.9.1.1-7, plus listed versions 4:2.9.1.1-34:2.9.1.1-44:2.9.1.1-54:2.9.1.1-6 |
4:2.9.1.1-7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1924 is a low vulnerability (CVSS 3.5) in Phpmyadmin, published April 23, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.63%, the 76th percentile. Fixed in phpmyadmin 4:2.11.5.2-1.
References
lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
securityfocus.com/bid/28906
security.gentoo.org/glsa/glsa-200805-02.xml
debian.org/security/2008/dsa-1557
secunia.com/advisories/32834
Show 12 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/41964
phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3
vupen.com/english/advisories/2008/1328/references
mandriva.com/security/advisories?name=MDVSA-2008:131
nvd.nist.gov/vuln/detail/CVE-2008-1924
github.com/advisories/GHSA-pfxq-3wfw-4c7m
security-tracker.debian.org/tracker/CVE-2008-1924