phpMyAdmin server_privileges.php SQL Injection Vulnerabilities. I. BACKGROUND phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the Web. II. DESCRIPTION phpMyAdmin server_privileges.php is prone to SQL Injection vulnerability. A remote attacker may execute arbitrary SQL command by sending specially-crafted URI to server_privileges.php db_name or checkprivs parameter. III. PUBLISH DATE 2005-12-7 IV. AUTHOR lwang@lwang.org V. AFFECTED SOFTWARE phpMyAdmin 2.7.0 is confirmed to affected. Older versions may also be affected. The following vendors distribute vulnerable phpMyAdmin package: The FreeBSD Project Gentoo Foundation Novell, Inc. (SuSE) The Debian Project (SuSE) VI. ANALYSIS in server_privileges.php line 27: if ( isset( $dbname ) ) { //if ( preg_match( '/\\\\(?:_|%)/i', $dbname ) ) { if ( preg_match( '/(?