The register_globals emulation in phpMyAdmin 2.7.0 rc1 allows remote attackers to exploit other vulnerabilities in phpMyAdmin by modifying the import_blacklist variable in grab_globals.php, which can then be used to overwrite other variables.

The version of phpMyAdmin installed on the remote host fails to properly protect the global 'import_blacklist' variable, which is used in the 'libraries/grab_globals.lib.php' script to protect global variables in its register_globals emulation layer.  An unauthenticated attacker can exploit this flaw to overwrite arbitrary variables, thereby opening the application up to remote / local file include as well as cross-site scripting attacks.

The remote host is affected by the vulnerability described in GLSA-200512-03 (phpMyAdmin: Multiple vulnerabilities)

    Stefan Esser from Hardened-PHP reported about multiple     vulnerabilities found in phpMyAdmin. The $GLOBALS variable allows     modifying the global variable import_blacklist to open phpMyAdmin to     local and remote file inclusion, depending on your PHP version     (CVE-2005-4079, PMASA-2005-9). Furthermore, it is also possible to     conduct an XSS attack via the $HTTP_HOST variable and a local and     remote file inclusion because the contents of the variable are under     total control of the attacker (CVE-2005-3665, PMASA-2005-8).
  Impact :

    A remote attacker may exploit these vulnerabilities by sending     malicious requests, causing the execution of arbitrary code with the     rights of the user running the web server. The cross-site scripting     issues allow a remote attacker to inject and execute malicious script     code or to steal cookie-based authentication credentials, potentially     allowing unauthorized access to phpMyAdmin.
  Workaround :

    There is no known workaround at this time.

The remote host is running phpMyAdmin, a web interface for administering MySQL database servers.  This version of phpMyAdmin is vulnerable to a flaw that allows remote attackers to overwrite global variables.  An attacker exploiting this flaw would only need to be able to send an HTTP query to the web server.  Successful exploitation would result in critical variables being overwritten.  This can lead to a partial loss of data integrity.

ID	Name	Product	Family	Severity
22124	phpMyAdmin import_blacklist Variable Overwriting	Nessus	CGI abuses	medium
20312	GLSA-200512-03 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
3319	phpMyAdmin < 2.7.0-pl1 Global Variable Overwrite	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2005-4079

high

Tenable Plugins

medium

medium

medium