headers
Thijs Kinkhorst | 15 Sep 20:50
Picon
Favicon

phpMyAdmin code execution (CVE request)

Hi all,

"- (2.11.9.1)  [security] Code execution vulnerability"

http://www.phpmyadmin.net/home_page/downloads.php?relnotes=1

"Welcome to this security update for phpMyAdmin 2.11.9.
Details will follow on http://phpmyadmin.net."

http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html

Attached patch is the fix from upstream. Judging from that (no other 
information is available yet), an authenticated user can supply a crafted 
sort_by parameter to server_databases.php, which will be turned in to 
executed PHP code because it is passed into create_function(). It is present 
at least since 2.9.1.

I would like to have a CVE id to refer to this issue.

Thijs
Attachment (pma_codeexecution.diff): text/x-diff, 2832 bytes
Permalink | Reply |
headers
Steven M. Christey | 16 Sep 02:48
Picon

Re: phpMyAdmin code execution (CVE request)


On Mon, 15 Sep 2008, Thijs Kinkhorst wrote:


*



> "- (2.11.9.1)  [security] Code execution vulnerability"
>
> http://www.phpmyadmin.net/home_page/downloads.php?relnotes=1
>
> "Welcome to this security update for phpMyAdmin 2.11.9.
> Details will follow on http://phpmyadmin.net."
>
> http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html


Use CVE-2008-4096, to be filled in later.

FYI to PHP auditors out there - add create_function() to your list of
dangerous functions.  I've seen a couple reports of vulnerabilities
related to it, and some PHP developer advocates singing its praises ("it's
like eval, but it's different!")

- Steve
Permalink | Reply |

Gmane