phpMyAdmin server_privileges.php SQL Injection Vulnerabilities.

Advisory Content :

phpMyAdmin server_privileges.php SQL Injection Vulnerabilities.

I. BACKGROUND
phpMyAdmin is a tool written in PHP intended to handle the administration
of MySQL over the Web.

II. DESCRIPTION
phpMyAdmin server_privileges.php is prone to SQL Injection vulnerability. A
remote attacker may execute arbitrary SQL command by sending
specially-crafted URI to server_privileges.php db_name or checkprivs
parameter.

III. PUBLISH DATE
2005-12-7

IV. AUTHOR
lwang (at) lwang (dot) org [email concealed]

V. AFFECTED SOFTWARE
phpMyAdmin 2.7.0 is confirmed to affected. Older versions may also be
affected.
The following vendors distribute vulnerable phpMyAdmin package:
The FreeBSD Project
Gentoo Foundation
Novell, Inc. (SuSE)
The Debian Project (SuSE)

VI. ANALYSIS
in server_privileges.php
line 27:
if ( isset( $dbname ) ) {
//if ( preg_match( '/\$?:_|%)/i', $dbname ) ) {
if ( preg_match( '/(?<!\$(?:_|%)/i', $dbname ) ) {
$dbname_is_wildcard = true;
} else {
$dbname_is_wildcard = false;
}
}
parameter $dbname is not validate properly.

line 1197:
if (isset($viewing_mode) && $viewing_mode == 'db') {
$db = $checkprivs;
$url_query .= '&goto=db_operations.php';

// Gets the database structure
$sub_part = '_structure';
require('./db_details_db_info.php');
echo "n";
} else {
require('./server_links.inc.php');
}

line 1241:
if ( empty( $adduser ) && empty( $checkprivs ) ) {

parameter $checkprivs not validate properly.

VII. Proof of Concept
http://victim/phpmyadmin/server_privileges.php?server=1&checkprivs='
http://victim/phpmyadmin/server_privileges.php?server=1&hostname='&usern
ame=1&dbname=1&tablename=1

VIII. SOLUTION
I have not contact the vendor, and no aware of any security patch till now.

IX. REFERENCE
http://www.phpmyadmin.net

SecurityReason - UPDATE :

phpMyAdmin's team answer to vulnerability announcement
of Dec 17, 2005

---------------------------------------------------------------------------
-----
We don't think that this is a real threat. The server_privileges.php
script checks at the beginning if the user is privileged. So, for this
attack to work, the victim's phpMyAdmin installation would have to be
set as to allow any user to auto-login as a privileged user! If this is
the case, this phpMyAdmin installation is wide open and this situation
has to be fixed by the person who configured phpMyAdmin.
--------------------------------------------------------------------------

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

phpMyAdmin server_privileges.php SQL Injection Vulnerabilities.