phpMyAdmin No Password Bypass Vulnerability (CVE-2017-18264)
Summary
CVE-2017-18264: An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. Affects phpmyadmin across 2 version ranges.
< 4:4.6.6-2
>= 6da64cc3b2ba4439574f914f51e161645375be96, < 9a9a6ab709eb6b1b2e82b7a15851ae93a31e9e45
Fixed in 4:4.6.6-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely-used open-source tool for managing MySQL databases through a web interface. It provides a user-friendly way to perform database operations, including creating, modifying, and deleting databases and tables. The tool is highly configurable and supports various authentication methods. However, certain versions of phpMyAdmin are vulnerable to a security issue that allows users to log in without a password, undermining the security measures set by administrators.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of the $cfg['Servers'][$i]['AllowNoPassword'] configuration setting in phpMyAdmin versions prior to 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. Under specific PHP versions, such as PHP 5, the restriction intended to prevent passwordless logins can be bypassed. This occurs because some implementations of the PHP substr function return false when given an empty string as the first argument, allowing unauthorized users to gain access to the system without a password. The ramifications of this vulnerability are severe, as it can lead to unauthorized access to sensitive database information.
How To Fix
Minimum fixed version
4:4.6.6-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can set the $cfg['Servers'][$i]['AllowNoPassword'] configuration to true in your phpMyAdmin configuration file to prevent unauthorized access. However, this is not a permanent solution and should only be used until you can apply the necessary updates.
Conclusion
CVE-2017-18264 is a critical vulnerability in phpMyAdmin that allows unauthorized access without a password due to a flaw in the configuration handling. It is essential to upgrade to the latest version to mitigate this risk and ensure the security of your database management system.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2017-18264 is a vulnerability in phpMyAdmin that allows users to log in without a password under certain PHP versions, despite the configuration setting meant to prevent this.
The vulnerability affects phpMyAdmin versions prior to 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2017-18264 is 9.8, indicating a critical level of severity.
If you cannot upgrade immediately, consider implementing temporary workarounds, such as adjusting configuration settings to limit access until a proper update can be performed.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
