Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files.

Improvements for 3.1.3.2: - [security] Insufficient output sanitizing when generating configuration file http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The setup script included with the version of phpMyAdmin installed on the remote host does not properly sanitize user-supplied input before using it to generate a config file for the application.  This version has the following vulnerabilities : 

  - The setup script inserts the unsanitized verbose server name into a C-style comment during config file generation.  

  - An attacker can save arbitrary data to the generated config file by altering the value of the 'textconfig' parameter during a POST request to config.php.  An unauthenticated remote attacker may be able to leverage these issues to execute arbitrary PHP code. 

The setup script included with the version of phpMyAdmin installed on the remote host does not properly sanitize user-supplied input before using it to generate a config file for the application. This version is affected by the following vulnerabilities :

  - The setup script inserts the unsanitized verbose server     name into a C-style comment during config file     generation.

  - An attacker can save arbitrary data to the generated     config file by altering the value of the 'textconfig'     parameter during a POST request to config.php.

An unauthenticated, remote attacker can exploit these issues to execute arbitrary PHP code.

phpMyAdmin Team reports :

Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Combined with ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code.
This issue is on different parameters than PMASA-2009-3 and it was missed out of our radar because it was not existing in 2.11.x branch.

ID	Name	Product	Family	Severity
36312	Fedora 10 : phpMyAdmin-3.1.3.2-1.fc10 (2009-3700)	Nessus	Fedora Local Security Checks	high
4997	phpMyAdmin < 3.1.3.2 Multiple RCE (PMASA-2009-4)	Nessus Network Monitor	CGI	high
36171	phpMyAdmin Setup Script Configuration Parameters Arbitrary PHP Code Injection (PMASA-2009-4)	Nessus	CGI abuses	high
36167	FreeBSD : phpmyadmin -- insufficient output sanitizing when generating configuration file (1a0e4cc6-29bf-11de-bdeb-0030843d3802)	Nessus	FreeBSD Local Security Checks	high
36165	Fedora 9 : phpMyAdmin-3.1.3.2-1.fc9 (2009-3692)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2009-1285

critical

Tenable Plugins

high

high

high

high

high