phpMyAdmin 4.6.x < 4.6.3 Multiple Vulnerabilities (PMASA-2016-17 - PMASA-2016-28)

High Nessus Plugin ID 99663

Synopsis

The remote web server hosts a PHP application that is affected by
multiple vulnerabilities.

Description

According to its self-reported version number, the phpMyAdmin
application hosted on the remote web server is 4.6.x prior to
4.6.3. It is, therefore, affected by the following vulnerabilities:

- A flaw exists in the setup/frames/index.inc.php script
that allows an unauthenticated, remote attacker to access
the program on a non-HTTPS connection and thereby inject
arbitrary BBCode against HTTP sessions. (CVE-2016-5701)

- An unspecified flaw exists, whenever the environment
lacks a PHP_SELF value, that allows an unauthenticated,
remote attacker to inject arbitrary attributes into
browser cookies by using a specially crafted URI.
(CVE-2016-5702)

- A flaw exists in the libraries/central_columns.lib.php
script when handling database names due to improper
sanitization of user-supplied input. An unauthenticated,
remote attacker can exploit this, via a crafted database
name, to inject or manipulate SQL queries in the
back-end database, resulting in modification or
disclosure of arbitrary data. (CVE-2016-5703)

- A cross-site scripting (XSS) vulnerability exists in the
templates/table/structure/display_table_stats.phtml
script when handling table comments due to improper
validation of input before returning it to users. An
unauthenticated, remote attacker can exploit this, via a
specially crafted request, to execute arbitrary script
code in a user's browser session. (CVE-2016-5704)

- Multiple cross-site scripting (XSS) vulnerabilities
exist due to improper validation of user-supplied input
before returning it to users. An unauthenticated, remote
attacker can exploit these, via specially crafted
requests, to execute arbitrary script code or HTML in a
a user's browser session. (CVE-2016-5705)

- A flaw exists in the js/get_scripts.js.php script when
handling a large array in the 'scripts' parameter during
the loading of a crafted JavaScript file. An
unauthenticated, remote attacker can exploit this to
cause a denial of service condition. (CVE-2016-5706)

- A information disclosure vulnerability exists in the
Example OpenID Authentication and Setup scripts that
allows an remote attacker, via multiple vectors, to
disclose the application's installation path in an
error message. (CVE-2016-5730)

- A reflected cross-site scripting (XSS) vulnerability
exists in the examples/openid.php script when handling
OpenID error messages due to improper validation of
input before returning it to users. An unauthenticated,
remote attacker can exploit this, via a specially
crafted request, to execute arbitrary script code in a
user's browser session. (CVE-2016-5731)

- A cross-site scripting (XSS) vulnerability exists in the
templates/table/structure/display_partitions.phtml
script when handling table parameters due to improper
validation of input before returning it to users. An
unauthenticated, remote attacker can exploit this, via a
specially crafted request, to execute arbitrary script
code in a user's browser session. (CVE-2016-5732)

- Multiple cross-site scripting (XSS) vulnerabilities
exist due to improper validation of user-supplied input
before returning it to users. An unauthenticated, remote
attacker can exploit these, via specially crafted
requests, to execute arbitrary script code or HTML in a
user's browser session. (CVE-2016-5733)

- A flaw exists in the table search and replace feature
due to improper sanitization of parameters before
passing them to the preg_replace() function. An
unauthenticated, remote attacker can exploit this, via
a specially crafted string, to execute arbitrary PHP
code. (CVE-2016-5734)

- An information disclosure vulnerability exists in the
libraries/Header.class.php script when handling
transformations due to a failure to use the 'no-referer'
Content Security Policy (CSP) protection mechanism. An
unauthenticated, remote attacker can exploit this, via a
specially crafted Transformation, to disclose sensitive
authentication token information, which then can be
potentially used to facilitate cross-site request
forgery (XSRF) attacks. (CVE-2016-5739)

Note that Nessus has not attempted to exploit these issues but has
instead relied only on the application's self-reported version number.

Solution

Upgrade to phpMyAdmin version 4.6.3 or later. Alternatively,
apply the patches referenced in the vendor advisories.

See Also

https://www.phpmyadmin.net/security/PMASA-2016-17/

https://www.phpmyadmin.net/security/PMASA-2016-18/

https://www.phpmyadmin.net/security/PMASA-2016-19/

https://www.phpmyadmin.net/security/PMASA-2016-20/

https://www.phpmyadmin.net/security/PMASA-2016-21/

https://www.phpmyadmin.net/security/PMASA-2016-22/

https://www.phpmyadmin.net/security/PMASA-2016-23/

https://www.phpmyadmin.net/security/PMASA-2016-24/

https://www.phpmyadmin.net/security/PMASA-2016-25/

https://www.phpmyadmin.net/security/PMASA-2016-26/

https://www.phpmyadmin.net/security/PMASA-2016-27/

https://www.phpmyadmin.net/security/PMASA-2016-28/

Plugin Details

Severity: High

ID: 99663

File Name: phpmyadmin_4_6_3.nasl

Version: 1.4

Type: remote

Family: CGI abuses

Published: 2017/04/25

Modified: 2018/07/24

Dependencies: 17219

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSS v3.0

Base Score: 9.8

Temporal Score: 9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:phpmyadmin:phpmyadmin

Exploit Available: false

Exploit Ease: No exploit is required

Patch Publication Date: 2016/06/23

Vulnerability Publication Date: 2016/06/23

Exploitable With

Core Impact

Metasploit (phpMyAdmin Authenticated Remote Code Execution)

Reference Information

CVE: CVE-2016-5701, CVE-2016-5702, CVE-2016-5703, CVE-2016-5704, CVE-2016-5705, CVE-2016-5706, CVE-2016-5730, CVE-2016-5731, CVE-2016-5732, CVE-2016-5733, CVE-2016-5734, CVE-2016-5739

BID: 91381, 91378, 91383, 91376, 91379, 91384, 91390, 91387, 91389, 91380, 91386, 91392