CVE-2013-4729: phpMyAdmin Global variables scope injection vulnerability
Summary
CVE-2013-4729: phpMyAdmin Global variables scope injection vulnerability. Affects phpmyadmin/phpmyadmin versions >= 4.0, < 4.0.4.1. Fixed in 4.0.4.1. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2013-4729 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source administration tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks. The vulnerability in question affects phpMyAdmin versions 4.0 to 4.0.4.1. This vulnerability allows remote authenticated users to modify the GLOBALS superglobal array, which can lead to unauthorized changes in the configuration of the application.
Vulnerability Detail
The vulnerability arises from a lack of proper input validation in the import.php file of phpMyAdmin. This file does not adequately restrict the file format specified in the input data, allowing an attacker to manipulate the GLOBALS superglobal array. By crafting a malicious request, a remote authenticated user can modify the GLOBALS array and potentially change the configuration of the application. This can have serious consequences, as it allows an attacker to gain unauthorized access or perform unauthorized actions on the database.
How To Fix
Minimum fixed version
4.0.4.1
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:4.0.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround can be implemented by manually validating and sanitizing the input data in the import.php file. This can be done by implementing proper input validation and filtering techniques to ensure that only valid file formats are accepted. Additionally, it is important to review and restrict the privileges of authenticated users to minimize the potential impact of any unauthorized changes to the configuration.
Conclusion
The phpMyAdmin Global variables scope injection vulnerability (CVE-2013-4729) allows remote authenticated users to modify the GLOBALS superglobal array and potentially change the configuration of the application. It is crucial to upgrade to phpMyAdmin version 4.0.4.1 or later to mitigate this vulnerability. If immediate upgrading is not possible, implementing proper input validation and filtering techniques in the import.php file can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source administration tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
Versions 4.0 to 4.0.4.1 of phpMyAdmin are affected by this vulnerability.
This vulnerability allows remote authenticated users to modify the GLOBALS superglobal array, potentially leading to unauthorized changes in the configuration of the application.
To fix this vulnerability, it is recommended to upgrade phpMyAdmin to version 4.0.4.1 or later.
If upgrading to the latest version is not immediately possible, a temporary workaround can be implemented by manually validating and sanitizing the input data in the import.php file.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
