phpMyAdmin 4.0.x < 4.0.10.16 Multiple Vulnerabilities (PMASA-2016-17, PMASA-2016-22 - PMASA-2016-24, PMASA-2016-26 - PMASA-2016-28)

High Nessus Plugin ID 99661

Synopsis

The remote web server hosts a PHP application that is affected by multiple vulnerabilities.

Description

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.16. It is, therefore, affected by the following vulnerabilities :

- A flaw exists in the setup/frames/index.inc.php script that allows an unauthenticated, remote attacker to access the program on a non-HTTPS connection and thereby inject arbitrary BBCode against HTTP sessions. (CVE-2016-5701)

- A flaw exists in the js/get_scripts.js.php script when handling a large array in the 'scripts' parameter during the loading of a crafted JavaScript file. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-5706)

- A information disclosure vulnerability exists in the Example OpenID Authentication and Setup scripts that allows an remote attacker, via multiple vectors, to disclose the application's installation path in an error message. (CVE-2016-5730)

- A reflected cross-site scripting (XSS) vulnerability exists in the examples/openid.php script when handling OpenID error messages due to improper validation of input before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2016-5731)

- Multiple cross-site scripting (XSS) vulnerabilities exist due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these, via specially crafted requests, to execute arbitrary script code or HTML in a user's browser session. (CVE-2016-5733)

- A flaw exists in the table search and replace feature due to improper sanitization of parameters before passing them to the preg_replace() function. An unauthenticated, remote attacker can exploit this, via a specially crafted string, to execute arbitrary PHP code. (CVE-2016-5734)

- An information disclosure vulnerability exists in the libraries/Header.class.php script when handling transformations due to a failure to use the 'no-referer' Content Security Policy (CSP) protection mechanism. An unauthenticated, remote attacker can exploit this, via a specially crafted Transformation, to disclose sensitive authentication token information, which then can be potentially used to facilitate cross-site request forgery (XSRF) attacks. (CVE-2016-5739)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to phpMyAdmin version 4.0.10.16 or later. Alternatively, apply the patches referenced in the vendor advisories.

See Also

https://www.phpmyadmin.net/security/PMASA-2016-17/

https://www.phpmyadmin.net/security/PMASA-2016-22/

https://www.phpmyadmin.net/security/PMASA-2016-23/

https://www.phpmyadmin.net/security/PMASA-2016-24/

https://www.phpmyadmin.net/security/PMASA-2016-26/

https://www.phpmyadmin.net/security/PMASA-2016-27/

https://www.phpmyadmin.net/security/PMASA-2016-28/

Plugin Details

Severity: High

ID: 99661

File Name: phpmyadmin_4_0_10_16.nasl

Version: 1.4

Type: remote

Family: CGI abuses

Published: 2017/04/25

Modified: 2018/07/24

Dependencies: 17219

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSS v3.0

Base Score: 9.8

Temporal Score: 9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:phpmyadmin:phpmyadmin

Exploit Available: false

Exploit Ease: No exploit is required

Patch Publication Date: 2016/06/23

Vulnerability Publication Date: 2016/06/23

Exploitable With

Core Impact

Metasploit (phpMyAdmin Authenticated Remote Code Execution)

Reference Information

CVE: CVE-2016-5701, CVE-2016-5706, CVE-2016-5730, CVE-2016-5731, CVE-2016-5733, CVE-2016-5734, CVE-2016-5739

BID: 91383, 91376, 91379, 91384, 91390, 91387, 91389

EDB-ID: 40185