Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the _REQUEST array, related to (a) libraries/common.lib.php, (b) session.inc.php, and (c) url_generating.lib.php. NOTE: the PHP unset function vector is covered by CVE-2006-3017.

This patch upgrades the phpMyAdmin package to version 2.9.1.1, including fixes for the security problems tracked by the Mitre CVE IDs CVE-2006-3388, CVE-2006-5116, CVE-2006-5117, and CVE-2006-5718.

The remote host is running phpMyAdmin, a web interface for administering MySQL database servers.  This version of phpMyAdmin is vulnerable to an HTML injection attack as well as several undisclosed vulnerabilities.  The details of the flaws will be released by the vendor; however, they have released a patched version of phpMyAdmin. 

The phpmyadmin update in DSA 1207 introduced a regression. This update corrects this flaw. For completeness, please find below the original advisory text :

  Several remote vulnerabilities have been discovered in phpMyAdmin, a   program to administrate MySQL over the web. The Common   Vulnerabilities and Exposures project identifies the following   problems :

    - CVE-2005-3621       CRLF injection vulnerability allows remote attackers       to conduct HTTP response splitting attacks.

    - CVE-2005-3665       Multiple cross-site scripting (XSS) vulnerabilities       allow remote attackers to inject arbitrary web script       or HTML via the (1) HTTP_HOST variable and (2) various       scripts in the libraries directory that handle header       generation.

    - CVE-2006-1678       Multiple cross-site scripting (XSS) vulnerabilities       allow remote attackers to inject arbitrary web script       or HTML via scripts in the themes directory.

    - CVE-2006-2418       A cross-site scripting (XSS) vulnerability allows       remote attackers to inject arbitrary web script or       HTML via the db parameter of footer.inc.php.

    - CVE-2006-5116       A remote attacker could overwrite internal variables       through the _FILES global variable.

The version of phpMyAdmin installed on the remote host allows an unauthenticated attacker to bypass variable blacklisting in its globalization routine and destroy, for example, the contents of session variables.

phpMyAdmin team reports :

We received a security advisory from Stefan Esser (sesser@hardened-php.net) and we wish to thank him for his work.

It was possible to inject arbitrary SQL commands by forcing an authenticated user to follow a crafted link.

Versions of phpMyAdmin prior to 2.9.1-rc1 are affected by the following vulnerabilities :

 - A series of cross-site request forgery (CSRF) flaws that allow remote attackers to perform unauthorized actions as another user. Specifically, this flaw affects the files 'libraries/common.lib.php', 'session.inc.php', and 'url_generating.lib.php' and is leveraged by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the '_REQUEST' array. (CVE-2006-5116)
 - Insufficient access control in the phpMyAdmin libraries directory under the web root. Exploiting this flaw would allow a remote attacker to obtain sensitive information via direct requests for certain files. (CVE-2006-5117)

ID	Name	Product	Family	Severity
27395	openSUSE 10 Security Update : phpMyAdmin (phpMyAdmin-2300)	Nessus	SuSE Local Security Checks	medium
3882	PHPMyAdmin < 2.9.2-rc2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
23656	Debian DSA-1207-2 : phpmyadmin - several vulnerabilities	Nessus	Debian Local Security Checks	medium
22512	phpMyAdmin < 2.9.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium
22487	FreeBSD : phpmyadmin -- CSRF vulnerabilities (19b17ab4-51e0-11db-a5ae-00508d6a62df)	Nessus	FreeBSD Local Security Checks	medium
3756	phpMyAdmin < 2.9.1-rc1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2006-5116

high

Tenable Plugins

medium

medium

medium

medium

medium

medium