phpMyAdmin vulnerabilities

phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a DoS attack in the replication status by using a specially crafted table name.

phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a weakness that allows a user with appropriate permissions to connect to an arbitrary MySQL server.

phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a DoS weakness in the table editing functionality.

The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.

An issue was discovered in phpMyAdmin that allows SQL injection via a crafted username or table name in the tracking functionality. The executed statements run with the privileges of the control user, granting access to configuration storage database tables and, if the control user has the necessary privileges, to some MySQL database tables.

An issue was discovered in phpMyAdmin that allows for a Denial of Service (DoS) attack through a very large request to the table partitioning function. All 4.6.x versions prior to 4.6.5 are affected.

An issue was discovered in phpMyAdmin that allows for BBCode injection on the login page via a crafted login request. All 4.6.x versions (prior to 4.6.5) are affected.

An issue was discovered in phpMyAdmin related to the limitation in URL matching, allowing for the bypass of URL white-list protection. This affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18).

An issue was discovered in phpMyAdmin that can lead to remote code execution in certain PHP installations running with the dbase extension. This affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).

An issue was discovered in phpMyAdmin that allows for remote code execution when the application is run as CGI. A user can pass a query string that is executed as a command-line argument by the file generator_plugin.sh.

An issue was discovered in phpMyAdmin allowing for SQL injection attacks through the user interface preference feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

An issue was discovered in phpMyAdmin that allows for an SQL injection attack through the export functionality by using a specially crafted database and/or table name. All 4.6.x versions prior to 4.6.4 are affected.

An issue was discovered in phpMyAdmin that allows for an SQL injection attack in the 'User group' and 'Designer' features. An attacker can exploit this vulnerability against the control user account. Affects versions 4.6.x (prior to 4.6.4) and 4.4.x (prior to 4.4.15.8).

An issue was discovered in phpMyAdmin that allows for an SQL injection attack through a specially crafted database and/or table name in the export functionality. This affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).

An issue was discovered in phpMyAdmin that allows arbitrary PHP commands to be executed through a specially crafted database name in the array export feature. This affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).

An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack, allowing an attacker with access to a user's browser cookie file to decrypt these credentials.

The Transformation implementation in phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, making it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header.

In phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3, a vulnerability allows remote attackers to cause a denial of service via a large array in the scripts parameter.

In phpMyAdmin versions 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4, there is a vulnerability related to the comparison of CSRF tokens that does not use a constant-time algorithm. This allows remote attackers to bypass intended access restrictions by measuring time differences.

The suggestPassword function in phpMyAdmin before version 4.0.10.13, 4.4.15.3, and 4.5.4 relies on the Math.random JavaScript function, making it easier for remote attackers to guess passwords via a brute-force approach.

SQL Injection vulnerability in phpMyAdmin 5.x before 5.2.0, located in the getTableCreationQuery function in CreateAddField.php. An attacker can inject malicious SQL queries via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.

An issue was discovered in phpMyAdmin related to improper stripping of the CSRF token from the return URL of the preference import action when the arg_separator is different from its default '&' value. This affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18).

An issue was discovered in phpMyAdmin due to a bug in serialized string parsing, allowing bypass of the protection offered by the PMA_safeUnserialize() function.

An issue was discovered in phpMyAdmin that allows bypassing the AllowRoot restriction and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp.

An issue was discovered in phpMyAdmin related to the PHP unserialize() function, which does not verify the validity of data before deserialization. This can lead to code execution due to the interaction with object instantiation and autoloading.

phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 do not properly choose delimiters, which may allow remote attackers to execute arbitrary PHP code via a crafted string.

In phpMyAdmin versions 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3, there is an SQL injection vulnerability in libraries/central_columns.lib.php. Remote attackers can execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML markup that executes in another user's session when they add a condition on it in Designer query mode.

phpMyAdmin through 5.2.3 contains an SQL injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.