phpMyAdmin 4.0.x < 4.0.10.19 / 4.4.x < 4.4.15.10 / 4.6.x < 4.6.6 Multiple Vulnerabilities (PMASA-2017-1 - PMASA-2017-7)

critical Nessus Plugin ID 99280

Language:

Synopsis

The remote web server hosts a PHP application that is affected by multiple vulnerabilities.

Description

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.19, 4.4.x prior to 4.4.15.10, or 4.6.x prior to 4.6.6. It is, therefore, affected by the following vulnerabilities :

- An open redirect vulnerability exists due to a failure to validate request paths before returning them to users. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted link, to redirect the user from the intended legitimate website to an arbitrary website of the attacker's choosing. (PMASA-2017-1)

- An arbitrary code execution vulnerability exists in the php-gettext component in the select_string() function due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (PMASA-2017-2, CVE-2015-8980)

- A denial of service vulnerability exists in the goto() function due to improper handling of table data. An unauthenticated, remote attacker can exploit this to launch a recursive include operation, resulting in a denial of service condition. (PMASA-2017-3)

- A flaw exists due to a failure to sanitize input passed via cookie parameters. An unauthenticated, remote attacker can exploit this to inject arbitrary CSS in themes. (PMASA-2017-4)

- An unspecified flaw exists that allows an unauthenticated, remote attacker to inject arbitrary values into browser cookies. (PMASA-2017-5, CVE-2016-5702)

- A server-side request forgery vulnerability exists that allows an authenticated, remote attacker to bypass access restrictions (e.g. host or network ACLs) and connect to hosts without the appropriate authorization.
Note that this vulnerability only affects the 4.6.x version branch. (PMASA-2017-6)

- A denial of service vulnerability exists in the replication status functionality due to improper handling of specially crafted table names. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (PMASA-2017-7)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to phpMyAdmin version 4.0.10.19 / 4.4.15.10 /4.6.6 or later.
Alternatively, apply the patches referenced in the vendor advisories.

Plugin Details

Severity: Critical

ID: 99280

File Name: phpmyadmin_pmasa_2017_1.nasl

Version: 1.8

Type: remote

Family: CGI abuses

Published: 4/11/2017

Updated: 11/22/2024

Configuration: Enable paranoid mode, Enable thorough checks

Supported Sensors: Nessus

Enable CGI Scanning: true

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2015-8980

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:phpmyadmin:phpmyadmin

Required KB Items: www/PHP, installed_sw/phpMyAdmin, Settings/ParanoidReport

Exploit Ease: No exploit is required

Patch Publication Date: 1/24/2017

Vulnerability Publication Date: 6/23/2016

Reference Information

CVE: CVE-2015-8980, CVE-2016-5702

BID: 91380, 95754

Detections

Analytics