phpMyAdmin is warning customers that a kit hosted on the SourceForge.net mirror system has been found to contain a backdoor that allows remote attackers to execute arbitrary PHP code.
The developers have been notified by the Tencent Security Response Center that the distribution contains a malicious file.
The affected mirror is called cdnetworks-kr-1,
the backdoor being located in the server_sync.php
Apparently, this isn’t the only corrupt file. The phpMyAdmin development team claims
that a second file - js/cross_framing_protection.js
– has also been modified. The vulnerability has been cataloged as being a critical one.
Users who downloaded phpMyAdmin-184.108.40.206-all-languages.zip
from the aforementioned mirror are advised to check if the download contains the server_sync.php file.
If the file is present, the entire distribution should be downloaded once again from a trusted mirror.