Multiple PHP remote file inclusion vulnerabilities in phpMyAdmin 2.6.1 allow remote attackers to execute arbitrary PHP code by modifying the (1) theme parameter to phpmyadmin.css.php or (2) cfg[Server][extension] parameter to database_interface.lib.php to reference a URL on a remote web server that contains the code.

A phpMyAdmin security announcement reports :

We received two bug reports by Maksymilian Arciemowicz about those vulnerabilities and we wish to thank him for his work. The vulnerabilities apply to those points :

- css/phpmyadmin.css.php was vulnerable against $cfg and GLOBALS variable injections. This way, a possible attacker could manipulate any configuration parameter. Using phpMyAdmin's theming mechanism, he was able to include arbitrary files. This is especially dangerous if php is not running in safe mode.

- A possible attacker could manipulate phpMyAdmin's localized strings via the URL and inject harmful JavaScript code this way, which could be used for XSS attacks.

The installed version of phpMyAdmin suffers from multiple local file include flaws due to its failure to sanitize user input prior to its use in PHP 'include' and 'require_once' calls.  Specifically, a remote attacker can control values for the 'GLOBALS[cfg][ThemePath]' parameter used in 'css/phpmyadmin.css.php' as well as the 'cfg[Server][extension]' parameter use in 'libraries/database_interface.lib.php', which enables him to read arbitrary files on the remote host and possibly even run arbitrary code, subject to the privileges of the web server process.

The remote host is running phpMyAdmin, an open-source software written in PHP to handle the administration of MySQL over the Web.
The remote version of this software is vulnerable to arbitrary command execution due to a lack of user-supplied data sanitization.
In addition, the remote host is vulnerable to multiple remote Cross-Site Scripting (XSS) flaws. An attacker exploiting these flaws would need to be able to convince a user into clicking on a malicious URL.  Upon successful exploitation, the attacker would be able to steal credentials or execute code within the browser.
Thirdly, the remote host is vulnerable to a flaw in the way that it handles user-supplied variables that are used within included files.  An attacker exploiting this flaw would pass malicious data to the server that the server would then include within the executing script code.  A successful exploit would result in the attacker being able to execute arbitrary code on the server. 

ID	Name	Product	Family	Severity
19016	FreeBSD : phpmyadmin -- arbitrary file include and XSS vulnerabilities (882ef43b-901f-11d9-a22c-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
17221	phpMyAdmin < 2.6.1 pl1 Multiple Script File Inclusions	Nessus	CGI abuses	medium
2452	phpMyAdmin < 2.6.1-pl1 RCE	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2005-0567

critical

Tenable Plugins

high

medium

high