Synopsis
The remote web server hosts a PHP application that is affected by multiple vulnerabilities.
Description
According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.4.x prior to 4.4.15.7. It is, therefore, affected by the following vulnerabilities:
- A flaw exists in the setup/frames/index.inc.php script that allows an unauthenticated, remote attacker to access the program on a non-HTTPS connection and thereby inject arbitrary BBCode against HTTP sessions. (CVE-2016-5701)
- A flaw exists in the libraries/central_columns.lib.php script when handling database names due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this, via a crafted database name, to inject or manipulate SQL queries in the back-end database, resulting in modification or disclosure of arbitrary data. (CVE-2016-5703)
- Multiple cross-site scripting (XSS) vulnerabilities exist due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these, via specially crafted requests, to execute arbitrary script code or HTML in a a user's browser session. (CVE-2016-5705)
- A flaw exists in the js/get_scripts.js.php script when handling a large array in the 'scripts' parameter during the loading of a crafted JavaScript file. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-5706)
- A information disclosure vulnerability exists in the Example OpenID Authentication and Setup scripts that allows an remote attacker, via multiple vectors, to disclose the application's installation path in an error message. (CVE-2016-5730)
- A reflected cross-site scripting (XSS) vulnerability exists in the examples/openid.php script when handling OpenID error messages due to improper validation of input before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2016-5731)
- Multiple cross-site scripting (XSS) vulnerabilities exist due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these, via specially crafted requests, to execute arbitrary script code or HTML in a user's browser session. (CVE-2016-5733)
- A flaw exists in the table search and replace feature due to improper sanitization of parameters before passing them to the preg_replace() function. An unauthenticated, remote attacker can exploit this, via a specially crafted string, to execute arbitrary PHP code. (CVE-2016-5734)
- An information disclosure vulnerability exists in the libraries/Header.class.php script when handling transformations due to a failure to use the 'no-referer' Content Security Policy (CSP) protection mechanism. An unauthenticated, remote attacker can exploit this, via a specially crafted Transformation, to disclose sensitive authentication token information, which then can be potentially used to facilitate cross-site request forgery (XSRF) attacks. (CVE-2016-5739)
Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to phpMyAdmin version 4.4.15.7 or later. Alternatively, apply the patches referenced in the vendor advisories.
Plugin Details
File Name: phpmyadmin_4_4_15_7.nasl
Configuration: Enable paranoid mode, Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:phpmyadmin:phpmyadmin
Required KB Items: www/PHP, Settings/ParanoidReport, installed_sw/phpMyAdmin
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Patch Publication Date: 6/23/2016
Vulnerability Publication Date: 6/23/2016
Exploitable With
Core Impact
Metasploit (phpMyAdmin Authenticated Remote Code Execution)
Reference Information
CVE: CVE-2016-5701, CVE-2016-5703, CVE-2016-5705, CVE-2016-5706, CVE-2016-5730, CVE-2016-5731, CVE-2016-5733, CVE-2016-5734, CVE-2016-5739
BID: 91376, 91378, 91379, 91381, 91383, 91384, 91387, 91389, 91390