Critical Vulnerability in phpMyAdmin: Bypass of No Password Restrictions
Summary
UBUNTU-CVE-2017-18264: An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. Affects phpmyadmin versions < 4:4.0.10-1ubuntu0.1+esm4. Fixed in 4:4.0.10-1ubuntu0.1+esm4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely-used open-source tool for managing MySQL databases through a web interface. It allows users to perform various database operations such as creating, modifying, and deleting databases and tables. The tool is known for its user-friendly interface and extensive feature set. However, certain versions of phpMyAdmin are vulnerable to a security flaw that can allow unauthorized access to databases without a password, posing significant risks to data integrity and security.
Vulnerability Detail
An issue was discovered in libraries/common.inc.php in phpMyAdmin versions prior to 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The vulnerability arises from a bypass of the $cfg['Servers'][$i]['AllowNoPassword'] setting, which is intended to prevent users without passwords from logging in. Under specific PHP versions, such as PHP 5, the substr function may return false when given an empty string as the first argument. This flaw can allow users with no password to gain access to the database, even when the administrator has configured the system to disallow such logins. The CVSS score for this vulnerability is 9.8, indicating a critical level of risk.
How To Fix
Minimum fixed version
4:4.0.10-1ubuntu0.1+esm4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the use of empty passwords by ensuring that the configuration setting $cfg['Servers'][$i]['AllowNoPassword'] is set to false. However, this does not fully mitigate the risk and should only be considered until the package is updated.
Conclusion
The vulnerability in phpMyAdmin allows unauthorized access to databases without a password due to a bypass of security settings. It is crucial to update to the latest patched versions to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for phpmyadmin →
FAQ
The vulnerability affects phpMyAdmin versions prior to 4.0.10.20, all 4.4.x versions, 4.6.x versions, and 4.7.0 prereleases.
The CVSS score for this vulnerability is 9.8, indicating a critical level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can allow unauthorized users to access sensitive database information without a password, leading to data breaches and loss of data integrity.
Yes, the permanent fix is to update phpMyAdmin to the latest patched versions as specified in the 'how to fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
