The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.

The remote host is affected by the vulnerability described in GLSA-201201-01 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in phpMyAdmin. Please       review the CVE identifiers and phpMyAdmin Security Advisories referenced       below for details.
  Impact :

    Remote attackers might be able to insert and execute PHP code, include       and execute local PHP files, or perform Cross-Site Scripting (XSS)       attacks via various vectors.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-3055     The configuration setup script does not properly     sanitise its output file, which allows remote attackers     to execute arbitrary PHP code via a crafted POST     request. In Debian, the setup tool is protected through     Apache HTTP basic authentication by default.

  - CVE-2010-3056     Various cross site scripting issues have been discovered     that allow a remote attacker to inject arbitrary web     script or HTML.

The setup script included with the version of phpMyAdmin installed on the remote host does not properly sanitize user-supplied input before using it to generate a config file for the application.  Submitting a specially crafted POST request can result in arbitrary PHP code injection.

A remote attacker could exploit this by using the setup script to generate a configuration file with injected PHP code, save it on the server, and load it, causing arbitrary PHP code to be executed with the privileges of the web server.

ID	Name	Product	Family	Severity
57433	GLSA-201201-01 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
48924	Debian DSA-2097-1 : phpmyadmin - insufficient input sanitising	Nessus	Debian Local Security Checks	high
48908	phpMyAdmin setup.php Arbitrary PHP Code Execution (PMASA-2010-4)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2010-3055

critical

Tenable Plugins

critical

high

high