CVE-2017-18264: phpMyAdmin Improper Privilege Management

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

phpMyAdmin is a popular open-source administration tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks such as creating, modifying, and deleting databases, tables, and queries. The vulnerability in question affects phpMyAdmin versions 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. This vulnerability relates to improper privilege management, which can lead to unauthorized access to the application by users who have no password set, even if the administrator has explicitly disallowed such access.

Vulnerability Detail

The vulnerability arises due to a bypass of the restrictions imposed by the configuration option $cfg['Servers'][$i]['AllowNoPassword'] = false. Under certain PHP versions (e.g., version 5), the restrictions can be circumvented, allowing users without a password to log in, even if the administrator has explicitly disabled this behavior. The issue stems from the fact that some implementations of the PHP substr function return false when given an empty string ('') as the first argument. This can be exploited to bypass the password check and gain unauthorized access to the phpMyAdmin application.

Workaround

If upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented by modifying the affected code. Specifically, the substr function call in the libraries/common.inc.php file needs to be replaced with a different implementation that does not exhibit the bypass behavior. Here is an example of how the code can be modified:

// Original code
if (substr($password, 0, 0) === '') {
    // Bypass password check
}

// Modified code
if (empty($password)) {
    // Perform alternative password check
}

By making this change, the vulnerability can be mitigated until a proper upgrade can be performed.

Conclusion

The vulnerability in phpMyAdmin allows users without a password to bypass the login restrictions, potentially leading to unauthorized access to the application and the underlying database. It is crucial to upgrade to a fixed version of phpMyAdmin to mitigate this vulnerability. If immediate upgrading is not possible, implementing the provided workaround can provide temporary relief. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for phpmyadmin/phpmyadmin →

FAQ