An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls.

The version of phpMyAdmin installed on the remote host does not correctly block access to LOAD DATA INFILE function leading to an attacker being able to read any file on the filesystem accessible with the web server permissions. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4639-1 advisory.

    It was discovered that there was a bug in the way phpMyAdmin handles the phpMyAdmin Configuration Storage     tables. An authenticated attacker could use this vulnerability to cause phpmyAdmin to leak sensitive     files. (CVE-2018-19968)

    It was discovered that phpMyAdmin incorrectly handled user input. An attacker could possibly use this for     an XSS attack. (CVE-2018-19970)

    It was discovered that phpMyAdmin mishandled certain input. An attacker could use this vulnerability to     execute a cross-site scripting (XSS) attack via a crafted URL. (CVE-2018-7260)

    It was discovered that phpMyAdmin failed to sanitize certain input. An attacker could use this     vulnerability to execute an SQL injection attack via a specially crafted database name. (CVE-2019-11768)

    It was discovered that phpmyadmin incorrectly handled some requests. An attacker could possibly use this     to perform a CSRF attack. (CVE-2019-12616)

    It was discovered that phpMyAdmin failed to sanitize certain input. An attacker could use this     vulnerability to execute an SQL injection attack via a specially crafted username. (CVE-2019-6798,     CVE-2020-10804, CVE-2020-5504)

    It was discovered that phpMyAdmin would allow sensitive files to be leaked if certain configuration     options were set. An attacker could use this vulnerability to access confidential information.
    (CVE-2019-6799)

    It was discovered that phpMyAdmin failed to sanitize certain input. An attacker could use this     vulnerability to execute an SQL injection attack via a specially crafted database or table name.
    (CVE-2020-10802)

    It was discovered that phpMyAdmin did not properly handle data from the database when displaying it. If an     attacker were to insert specially- crafted data into certain database tables, the attacker could execute a     cross-site scripting (XSS) attack. (CVE-2020-10803)

    It was discovered that phpMyAdmin was vulnerable to an XSS attack. If a victim were to click on a crafted     link, an attacker could run malicious JavaScript on the victim's system. (CVE-2020-26934)

    It was discovered that phpMyAdmin did not properly handler certain SQL statements in the search feature.
    An attacker could use this vulnerability to inject malicious SQL into a query. (CVE-2020-26935)

    It was discovered that phpMyAdmin did not properly sanitize certain input. An attacker could use this     vulnerability to possibly execute an HTML injection or a cross-site scripting (XSS) attack.
    (CVE-2019-19617)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.8.5. It is, therefore, affected by multiple vulnerabilities.

  - When AllowArbitraryServer configuration set to true,     with the use of a rogue MySQL server, an attacker can     read any file on the server that the web server's user     can access.phpMyadmin attempts to block the use of LOAD     DATA INFILE, but due to a bug in PHP, this check is not     honored. Additionally, when using the 'mysql' extension,     mysql.allow_local_infile is enabled by default. Both of     these conditions allow the attack to occur.
    (CVE-2019-6799)

  - A vulnerability was reported where a specially crafted     username can be used to trigger an SQL injection attack     through the designer feature. (CVE-2019-6798)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.x prior to 4.8.5. It is, therefore, affected by at least one of the following vulnerabilities:

  - A SQL injection (SQLi) vulnerability exists in phpMyAdmin due to improper validation of user-supplied input.
  An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database,   resulting in the disclosure or manipulation of arbitrary data (CVE-2019-6798).

  - An arbitrary file read vulnerability exists in phpMyAdmin when the AllowArbitraryServer configuration setting is   set to true. An unauthenticated, remote attacker can exploit this, via a rogue MySQL server, to read arbitrary files   and disclose sensitive information (CVE-2019-6799).

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

An information leak issue was discovered in phpMyAdmin. An attacker can read any file on the server that the web server's user can access.
This is related to the mysql.allow_local_infile PHP configuration.
When the AllowArbitraryServer configuration setting is set to false (default), the attacker needs a local MySQL account. When set to true, the attacker can exploit this with the use of a rogue MySQL server.

For Debian 8 'Jessie', this problem has been fixed in version 4:4.2.12-2+deb8u5.

We recommend that you upgrade your phpmyadmin packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for phpMyAdmin to version 4.8.5 fixes the following issues :

Security issues fixed :

  - CVE-2019-6799: Fixed an arbitrary file read     vulnerability (boo#1123272)

  - CVE-2019-6798: Fixed a SQL injection in the designer     interface (boo#1123271)

Other changes :

  - Fix rxport to SQL format not available

  - Fix QR code not shown when adding two-factor     authentication to a user account

  - Fix issue with adding a new user in MySQL 8.0.11 and     newer

  - Fix frozen interface relating to Text_Plain_Sql plugin

  - Fix missing table level operations tab

ID	Name	Product	Family	Severity
113294	phpMyAdmin 4.x < 4.8.5 Arbitary File Read	Web App Scanning	Component Vulnerability	medium
143119	Ubuntu 18.04 LTS : phpMyAdmin vulnerabilities (USN-4639-1)	Nessus	Ubuntu Local Security Checks	critical
126705	phpMyAdmin 4.0 < 4.8.5 Multiple Vulnerabilities (PMASA-2019-1), (PMASA-2019-2)	Nessus	CGI abuses	critical
123416	phpMyAdmin 4.x < 4.8.5 Multiple Vulnerabilities (PMASA-2019-1) (PMASA-2019-2)	Nessus	CGI abuses	critical
122490	Debian DLA-1692-1 : phpmyadmin security update	Nessus	Debian Local Security Checks	medium
122294	openSUSE Security Update : phpMyAdmin (openSUSE-2019-194)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2019-6799

medium

Tenable Plugins

medium

critical

critical

critical

medium

critical