Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

The setup script included with the version of phpMyAdmin installed on the remote host does not properly sanitize user-supplied input to several variables before using them to generate a config file for the application. Using specially crafted POST requests, an unauthenticated, remote attacker may be able to leverage this issue to execute arbitrary PHP code.

This update of phpMyAdmin fixes multiple vulnerabilities :

  - CVE-2009-1148: directory traversal

  - CVE-2009-1149: CRLF injection

  - CVE-2009-1150: cross-site scripting

  - CVE-2009-1151: static code injection

The remote host is affected by the vulnerability described in GLSA-200906-03 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in phpMyAdmin:
    Greg Ose discovered that the setup script does not sanitize input     properly, leading to the injection of arbitrary PHP code into the     configuration file (CVE-2009-1151).
    Manuel Lopez Gallego and     Santiago Rodriguez Collazo reported that data from cookies used in the     'Export' page is not properly sanitized (CVE-2009-1150).
  Impact :

    A remote unauthorized attacker could exploit the first vulnerability to     execute arbitrary code with the privileges of the user running     phpMyAdmin and conduct Cross-Site Scripting attacks using the second     vulnerability.
  Workaround :

    Removing the 'scripts/setup.php' file protects you from CVE-2009-1151.

Several remote vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1150     Cross site scripting vulnerability in the export page     allow for an attacker that can place crafted cookies     with the user to inject arbitrary web script or HTML.

  - CVE-2009-1151     Static code injection allows for a remote attacker to     inject arbitrary code into phpMyAdmin via the setup.php     script. This script is in Debian under normal     circumstances protected via Apache authentication.
    However, because of a recent worm based on this exploit,     we are patching it regardless, to also protect     installations that somehow still expose the setup.php     script.

The setup script included with the version of phpMyAdmin installed on the remote host does not properly sanitize user-supplied input to several variables before using them to generate a config file for the application.  Using specially crafted POST requests, an unauthenticated, remote attacker may be able to leverage this issue to execute arbitrary PHP code.

Note that the application is also reportedly affected by several other issues, although Nessus has not actually checked for them.

phpMyAdmin reports :

Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.

ID	Name	Product	Family	Severity
700609	phpMyAdmin 2.11.x < 2.11.9.5 / 3.x < 3.1.3.1 RCE (PMASA-2009-3)	Nessus Network Monitor	CGI	high
40108	openSUSE Security Update : phpMyAdmin (phpMyAdmin-711)	Nessus	SuSE Local Security Checks	high
39570	GLSA-200906-03 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
39569	Debian DSA-1824-1 : phpmyadmin - several vulnerabilities	Nessus	Debian Local Security Checks	high
36170	phpMyAdmin setup.php save Action Arbitrary PHP Code Injection (PMASA-2009-3)	Nessus	CGI abuses	high
36081	openSUSE 10 Security Update : phpMyAdmin (phpMyAdmin-6133)	Nessus	SuSE Local Security Checks	high
36012	FreeBSD : phpmyadmin -- insufficient output sanitizing when generating configuration file (06f9174f-190f-11de-b2f0-001c2514716c)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2009-1151

critical

Tenable Plugins

high

high

high

high

high

high

high