Vulnerability in phpMyAdmin: Arbitrary File Read, Session Data Disclosure, XSS, and SQL Injection
Summary
DSA-1557-1: phpmyadmin - several vulnerabilities. Affects phpmyadmin versions < 4:2.9.1.1-7. Fixed in 4:2.9.1.1-7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is an application used to administer MySQL databases over the web. It provides a user-friendly interface for managing databases, tables, queries, and more. This vulnerability affects phpMyAdmin versions 4:2.9.1.1-7 and earlier. The vulnerability allows attackers with CREATE table permissions to read arbitrary files readable by the webserver via a crafted HTTP POST request. Additionally, the PHP session data file stored the username and password of a logged-in user, which could be accessed by a local user in certain setups. Cross-site scripting (XSS) and SQL injection attacks were also possible for attackers with permission to create cookies in the same cookie domain as phpMyAdmin.
Vulnerability Detail
The vulnerability in phpMyAdmin allows attackers with CREATE table permissions to read arbitrary files readable by the webserver. By sending a specially crafted HTTP POST request, an attacker can exploit this vulnerability and gain unauthorized access to sensitive files. Additionally, the PHP session data file stores the username and password of a logged-in user, which can be accessed by a local user. This poses a risk to the confidentiality of user credentials. Furthermore, attackers with permission to create cookies in the same cookie domain as phpMyAdmin can execute cross-site scripting (XSS) and SQL injection attacks, potentially compromising the integrity and security of the application and its data.
How To Fix
Minimum fixed version
4:2.9.1.1-7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general security practice, it is advisable to ensure that the webserver has appropriate file permissions and access controls in place to prevent unauthorized access to sensitive files. Additionally, it is recommended to regularly monitor and review the PHP session data file to detect any unauthorized access or disclosure of user credentials.
Conclusion
In conclusion, this vulnerability in phpMyAdmin allows attackers to read arbitrary files, disclose session data, and perform XSS and SQL injection attacks. It is crucial to upgrade to the latest version of phpMyAdmin to mitigate these risks. Regular monitoring of file permissions and access controls is also recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is an application used to administrate MySQL databases over the web. It provides a user-friendly interface for managing databases, tables, queries, and more.
This vulnerability affects phpMyAdmin versions 4:2.9.1.1-7 and earlier.
The vulnerability allows attackers to read arbitrary files readable by the webserver, potentially exposing sensitive information. It also allows disclosure of the username and password of a logged-in user in certain setups. Furthermore, it enables cross-site scripting (XSS) and SQL injection attacks.
To fix this vulnerability, it is recommended to upgrade your phpMyAdmin package to version 4:2.9.1.1-7 or later. This can be done by updating the package using the package manager of your operating system.
There is no specific workaround mentioned for this vulnerability. However, it is advisable to ensure appropriate file permissions and access controls are in place to prevent unauthorized access to sensitive files.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
