phpMyAdmin server_privileges.php SQL Injection Vulnerabilities.

[Alice Bryson]

phpMyAdmin server_privileges.php SQL Injection Vulnerabilities.

I. BACKGROUND
phpMyAdmin is a tool written in PHP intended to handle the =
administration of MySQL over the Web.

II. DESCRIPTION
phpMyAdmin server_privileges.php is prone to SQL Injection =
vulnerability. A remote attacker may execute arbitrary SQL command by =
sending specially-crafted URI to server_privileges.php db_name or =
checkprivs parameter.=20

III. PUBLISH DATE
2005-12-7

IV. AUTHOR
lwang@lwang.org

V. AFFECTED SOFTWARE
phpMyAdmin 2.7.0 is confirmed to affected. Older versions may also be =
affected.
The following vendors distribute vulnerable phpMyAdmin package:
The FreeBSD Project=20
Gentoo Foundation=20
Novell, Inc. (SuSE)=20
The Debian Project (SuSE)

VI. ANALYSIS
in server_privileges.php
line 27:
if ( isset( $dbname ) ) {
//if ( preg_match( '/\\\\(?:_|%)/i', $dbname ) ) {
if ( preg_match( '/(?<!\\\\)(?:_|%)/i', $dbname ) ) {
$dbname_is_wildcard =3D true;
} else {
$dbname_is_wildcard =3D false;
}
}
parameter $dbname is not validate properly.

line 1197:
if (isset($viewing_mode) && $viewing_mode =3D=3D 'db') {
$db =3D $checkprivs;
$url_query .=3D '&amp;goto=3Ddb_operations.php';

// Gets the database structure
$sub_part =3D '_structure';
require('./db_details_db_info.php');
echo "\n";
} else {
require('./server_links.inc.php');
}

line 1241:=20
if ( empty( $adduser ) && empty( $checkprivs ) ) {

parameter $checkprivs not validate properly.

VII. Proof of Concept
http://victim/phpmyadmin/server_priv...&checkprivs=3D'
http://victim/phpmyadmin/server_priv...D1&hostname=3D'&us=
ername=3D1&dbname=3D1&tablename=3D1

VIII. SOLUTION
I have not contact the vendor, and no aware of any security patch till =
now.

IX. REFERENCE=20
http://www.phpmyadmin.net

[michal@cihar.com]

Hi

There is no vulnerability in this - user needs to be logged in. You can do same (without messing SQL injection) by directly passing SQL statements to import.php or sql.php. Yes phpMyAdmin allows to execute queries to authenticated users, but it's main tas
k of this program and can not be considered as vulnerability.

Michal