Backdoor in phpMyAdmin Allows Hackers to Execute PHP Code

Only a particular distribution from is affected

phpMyAdmin is warning customers that a kit hosted on the mirror system has been found to contain a backdoor that allows remote attackers to execute arbitrary PHP code.

The developers have been notified by the Tencent Security Response Center that the distribution contains a malicious file.

The affected mirror is called cdnetworks-kr-1, the backdoor being located in the server_sync.php file.

Apparently, this isn’t the only corrupt file. The phpMyAdmin development team claims that a second file - js/cross_framing_protection.js – has also been modified. The vulnerability has been cataloged as being a critical one.

Users who downloaded from the aforementioned mirror are advised to check if the download contains the server_sync.php file.

If the file is present, the entire distribution should be downloaded once again from a trusted mirror.

Hot right now  ·  Latest news