CVE-2006-6943

PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_orange/layout.inc.php; and via the (1) lang[], (2) target[], (3) db[], (4) goto[], (5) table[], and (6) tbl_group[] array arguments to (c) index.php, and the (7) back[] argument to (d) sql.php; and an invalid (8) sort_by parameter to (e) server_databases.php and (9) db parameter to (f) db_printview.php.

• CWE-20

• http://marc.info/?l=bugtraq&m=116370414309444&w=2Third Party Advisory
• http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8Patch, Vendor Advisory
• http://www.securityfocus.com/bid/21137Third Party Advisory, VDB Entry
• http://marc.info/?l=bugtraq&m=116370414309444&w=2Third Party Advisory
• http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8Patch, Vendor Advisory
• http://www.securityfocus.com/bid/21137Third Party Advisory, VDB Entry

Published

Jan 19, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-6937SQL injection vulnerability in displaypic.asp in Xtreme ASP …
• CVE-2006-6938Directory traversal vulnerability in includes/common.php in …
• CVE-2006-6939GNU ed before 0.3 allows local users to overwrite arbitrary …
• CVE-2006-6940Buffer overflow in the ParseHeader function in clsOWA.cls in…
• CVE-2006-6941index.php in FreeWebshop 2.2.2 and earlier allows remote att…
• CVE-2006-6942Multiple cross-site scripting (XSS) vulnerabilities in PhpMy…
• CVE-2006-6944phpMyAdmin before 2.9.1.1 allows remote attackers to bypass …
• CVE-2006-6945SQL injection vulnerability in Virtuemart 1.0.7 allows remot…
• CVE-2006-6946The web server in the NEC MultiWriter 1700C allows remote at…
• CVE-2006-6947The FTP server in the NEC MultiWriter 1700C allows remote at…
• CVE-2006-6948MyODBC Japanese conversion edition 3.51.06, 2.50.29, and 2.5…
• CVE-2006-6949Conti FTPServer 1.0 Build 2.8 stores user passwords in clear…