CVE-2014-8959

Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in...

6.5 MediumFix available

CVE-2014-8959 is a medium vulnerability (CVSS 6.5) in Phpmyadmin, published November 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.73%, the 86th percentile. Fixed in phpmyadmin 4:4.2.12-1.

What does this mean?

Severity: 6.5 MediumCVSS 2.0, NVD
Exploit chance: 2.73%EPSS, 86th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 4:4.2.12-1phpmyadmin +6 more

Description

Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files via a crafted geometry-type parameter.

Exploit likelihood

2.73%Up 1.5 points since Feb 4, 2022

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`phpmyadmin` Debian:12	before 4:4.2.12-1	4:4.2.12-1
`phpmyadmin` Debian:13	before 4:4.2.12-1	4:4.2.12-1
`phpmyadmin` Debian:14	before 4:4.2.12-1	4:4.2.12-1
`phpmyadmin` Mageia:3 From an advisory covering 4 CVEs	before 4.1.14.7-1.mga3	4.1.14.7-1.mga3
`phpmyadmin` Mageia:4 From an advisory covering 4 CVEs	before 4.1.14.7-1.mga4	4.1.14.7-1.mga4
`phpmyadmin` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 4:4.0.6-14:4.0.8-14:4.0.9-14:4.0.10-14:4.0.10-1ubuntu0.1 Show 4 moreShow less 4:4.0.10-1ubuntu0.1+esm14:4.0.10-1ubuntu0.1+esm24:4.0.10-1ubuntu0.1+esm34:4.0.10-1ubuntu0.1+esm4	None known
`phpMyAdmin` openSUSE:Tumbleweed From an advisory covering 124 CVEs	before 4.6.5.2-1.1	4.6.5.2-1.1

What each source reports

NVD Score used6.5

Record: CVE-2014-8959
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-22
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2014-8959
Updated: 2026-11-02

EUVDEUVD-2014-8786No score

Record: EUVD-2014-8786
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hvw8-56v7-x24qNo score

Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in...

Record: GHSA-hvw8-56v7-x24q
Weakness: CWE-22
Updated: 2026-11-02

OSVNo score

Record: CVE-2014-8959
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-8959No score

Record: DEBIAN-CVE-2014-8959
Updated: 2026-11-02

OSVMGASA-2014-0495No score

Updated phpmyadmin packages fix security vulnerabilities

Updated phpmyadmin package fixes security vulnerabilities:

In phpMyAdmin before 4.1.14.7, with a crafted database, table or column name it is possible to trigger an XSS attack in the table browse page, with a crafted ENUM value it is possible to trigger XSS attacks in the table print view and zoom search pages, and with a crafted value for font size it is possible to trigger an XSS attack in the home page (CVE-2014-8958).

In phpMyAdmin before 4.1.14.7, in the GIS editor feature, a parameter specifying the geometry type was not correcly validated, opening the door to a local file inclusion attack (CVE-2014-8959).

In phpMyAdmin before 4.1.14.7, with a crafted file name it is possible to trigger an XSS in the error reporting page (CVE-2014-8960).

In phpMyAdmin before 4.1.14.7, in the error reporting feature, a parameter specifying the file was not correctly validated, allowing the attacker to derive the line count of an arbitrary file (CVE-2014-8961).

Record: MGASA-2014-0495
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10054-1No score

phpMyAdmin-4.6.5.2-1.1 on GA media

These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.