Vulnerabilities > CVE-2016-6612 - Information Exposure vulnerability in PHPmyadmin

047910
CVSS 4.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
phpmyadmin
CWE-200
nessus

Summary

An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

Vulnerable Configurations

Part Description Count
Application
Phpmyadmin
60

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-626.NASL
    descriptionPhpmyadmin, a web administration tool for MySQL, had several vulnerabilities reported. CVE-2016-6606 A pair of vulnerabilities were found affecting the way cookies are stored. The decryption of the username/password is vulnerable to a padding oracle attack. The can allow an attacker who has access to a user
    last seen2020-03-17
    modified2016-09-19
    plugin id93566
    published2016-09-19
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93566
    titleDebian DLA-626-1 : phpmyadmin security update
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-626-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(93566);
      script_version("2.8");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2016-6606", "CVE-2016-6607", "CVE-2016-6609", "CVE-2016-6611", "CVE-2016-6612", "CVE-2016-6613", "CVE-2016-6614", "CVE-2016-6620", "CVE-2016-6622", "CVE-2016-6623", "CVE-2016-6624", "CVE-2016-6630", "CVE-2016-6631");
    
      script_name(english:"Debian DLA-626-1 : phpmyadmin security update");
      script_summary(english:"Checks dpkg output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Phpmyadmin, a web administration tool for MySQL, had several
    vulnerabilities reported.
    
    CVE-2016-6606
    
    A pair of vulnerabilities were found affecting the way cookies are
    stored.
    
    The decryption of the username/password is vulnerable to a
    padding oracle attack. The can allow an attacker who has
    access to a user's browser cookie file to decrypt the
    username and password.
    
    A vulnerability was found where the same initialization
    vector is used to hash the username and password stored in
    the phpMyAdmin cookie. If a user has the same password as
    their username, an attacker who examines the browser cookie
    can see that they are the same — but the attacker can
    not directly decode these values from the cookie as it is
    still hashed.
    
    CVE-2016-6607
    
    Cross site scripting vulnerability in the replication feature
    
    CVE-2016-6609
    
    A specially crafted database name could be used to run arbitrary PHP
    commands through the array export feature.
    
    CVE-2016-6611
    
    A specially crafted database and/or table name can be used to trigger
    a SQL injection attack through the SQL export functionality.
    
    CVE-2016-6612
    
    A user can exploit the LOAD LOCAL INFILE functionality to expose files
    on the server to the database system.
    
    CVE-2016-6613
    
    A user can specially craft a symlink on disk, to a file which
    phpMyAdmin is permitted to read but the user is not, which phpMyAdmin
    will then expose to the user.
    
    CVE-2016-6614
    
    A vulnerability was reported with the %u username replacement
    functionality of the SaveDir and UploadDir features. When the username
    substitution is configured, a specially crafted user name can be used
    to circumvent restrictions to traverse the file system.
    
    CVE-2016-6620
    
    A vulnerability was reported where some data is passed to the PHP
    unserialize() function without verification that it's valid serialized
    data. Due to how the PHP function operates, unserialization can result
    in code being loaded and executed due to object instantiation and
    autoloading, and a malicious user may be able to exploit this.
    Therefore, a malicious user may be able to manipulate the stored data
    in a way to exploit this weakness.
    
    CVE-2016-6622
    
    An unauthenticated user is able to execute a denial of service attack
    by forcing persistent connections when phpMyAdmin is running with
    $cfg['AllowArbitraryServer']=true;.
    
    CVE-2016-6623
    
    A malicious authorized user can cause a denial of service attack on a
    server by passing large values to a loop.
    
    CVE-2016-6624
    
    A vulnerability was discovered where, under certain circumstances, it
    may be possible to circumvent the phpMyAdmin IP-based authentication
    rules. When phpMyAdmin is used with IPv6 in a proxy server
    environment, and the proxy server is in the allowed range but the
    attacking computer is not allowed, this vulnerability can allow the
    attacking computer to connect despite the IP rules.
    
    CVE-2016-6630
    
    An authenticated user can trigger a denial of service attack by
    entering a very long password at the change password dialog.
    
    CVE-2016-6631
    
    A vulnerability was discovered where a user can execute a remote code
    execution attack against a server when phpMyAdmin is being run as a
    CGI application. Under certain server configurations, a user can pass
    a query string which is executed as a command-line argument by shell
    scripts.
    
    For Debian 7 'Wheezy', these problems have been fixed in version
    3.4.11.1-2+deb7u6.
    
    We recommend that you upgrade your phpmyadmin packages.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2016/09/msg00019.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/wheezy/phpmyadmin"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Upgrade the affected phpmyadmin package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:phpmyadmin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/12/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/09/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/09/19");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"7.0", prefix:"phpmyadmin", reference:"3.4.11.1-2+deb7u6")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyCGI abuses
    NASL idPHPMYADMIN_PMASA_2016_29.NASL
    descriptionAccording to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.17, 4.4.x prior to 4.4.15.8, or 4.6.x prior to 4.6.4. It is, therefore, affected by the following vulnerabilities : - An information disclosure vulnerability exists due to the use of an algorithm that is vulnerable to padding oracle attacks. An unauthenticated, remote attacker can exploit this to decrypt information without the key, resulting in the disclosure of usernames and passwords. (CVE-2016-6606) - A cross-site scripting (XSS) vulnerability exists in the replication_gui.lib.php script due to improper validation of user-supplied input to the
    last seen2020-06-01
    modified2020-06-02
    plugin id95027
    published2016-11-21
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95027
    titlephpMyAdmin 4.0.x < 4.0.10.17 / 4.4.x < 4.4.15.8 / 4.6.x < 4.6.4 Multiple Vulnerabilities (PMASA-2016-29 - PMASA-2016-56)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1821.NASL
    descriptionMultiple security vulnerabilities were fixed in phpmyadmin, a MySQL web administration tool, which prevent possible SQL injection attacks, CSRF, the bypass of user restrictions, information disclosure or denial of service. For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id125957
    published2019-06-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125957
    titleDebian DLA-1821-1 : phpmyadmin security update
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-1021.NASL
    descriptionphpMyAdmin was updated to version 4.4.15.8 (2016-08-16) to fix the following issues : - Upstream changelog for 4.4.15.8 : - Improve session cookie code for openid.php and signon.php example files - Full path disclosure in openid.php and signon.php example files - Unsafe generation of BlowfishSecret (when not supplied by the user) - Referrer leak when phpinfo is enabled - Use HTTPS for wiki links - Improve SSL certificate handling - Fix full path disclosure in debugging code - Administrators could trigger SQL injection attack against users - other fixes - Remove Swekey support - Security fixes: https://www.phpmyadmin.net/security/ - Weaknesses with cookie encryption see PMASA-2016-29 (CVE-2016-6606, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-30 (CVE-2016-6607, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-31 (CVE-2016-6608, CWE-661) - PHP code injection see PMASA-2016-32 (CVE-2016-6609, CWE-661) - Full path disclosure see PMASA-2016-33 (CVE-2016-6610, CWE-661) - SQL injection attack see PMASA-2016-34 (CVE-2016-6611, CWE-661) - Local file exposure through LOAD DATA LOCAL INFILE see PMASA-2016-35 (CVE-2016-6612, CWE-661) - Local file exposure through symlinks with UploadDir see PMASA-2016-36 (CVE-2016-6613, CWE-661) - Path traversal with SaveDir and UploadDir see PMASA-2016-37 (CVE-2016-6614, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-38 (CVE-2016-6615, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-39 (CVE-2016-6616, CWE-661) - SQL injection vulnerability see PMASA-2016-40 (CVE-2016-6617, CWE-661) - Denial-of-service attack through transformation feature see PMASA-2016-41 (CVE-2016-6618, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-42 (CVE-2016-6619, CWE-661) - Verify data before unserializing see PMASA-2016-43 (CVE-2016-6620, CWE-661) - SSRF in setup script see PMASA-2016-44 (CVE-2016-6621, CWE-661) - Denial-of-service attack with $cfg[
    last seen2020-06-05
    modified2016-08-30
    plugin id93212
    published2016-08-30
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/93212
    titleopenSUSE Security Update : phpMyAdmin (openSUSE-2016-1021)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_EF70B201645D11E69CDC6805CA0B3D42.NASL
    descriptionThe phpmyadmin development team reports : Weakness with cookie encryption Multiple XSS vulnerabilities Multiple XSS vulnerabilities PHP code injection Full path disclosure SQL injection attack Local file exposure Local file exposure through symlinks with UploadDir Path traversal with SaveDir and UploadDir Multiple XSS vulnerabilities SQL injection attack SQL injection attack Denial of service (DOS) attack in transformation feature SQL injection attack as control user Unvalidated data passed to unserialize() DOS attack with forced persistent connections Denial of service (DOS) attack by for loops IPv6 and proxy server IP-based authentication rule circumvention Detect if user is logged in Bypass URL redirect protection Referrer leak in url.php Reflected File Download attack ArbitraryServerRegexp bypass Denial of service (DOS) attack by changing password to a very long string Remote code execution vulnerability when run as CGI Summary Denial of service (DOS) attack with dbase extension Remote code execution vulnerability when PHP is running with dbase extension
    last seen2020-06-01
    modified2020-06-02
    plugin id93024
    published2016-08-18
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93024
    titleFreeBSD : phpmyadmin -- multiple vulnerabilities (ef70b201-645d-11e6-9cdc-6805ca0b3d42)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201701-32.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201701-32 (phpMyAdmin: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in phpMyAdmin. Please review the CVE identifiers referenced below for details. Impact : A authenticated remote attacker could exploit these vulnerabilities to execute arbitrary PHP Code, inject SQL code, or to conduct Cross-Site Scripting attacks. In certain configurations, an unauthenticated remote attacker could cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id96426
    published2017-01-12
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96426
    titleGLSA-201701-32 : phpMyAdmin: Multiple vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-1027.NASL
    descriptionThis phpMyAdmin update to version 4.4.15.8 fixes the following issues : Security issues fixed : - Improve session cookie code for openid.php and signon.php example files - Full path disclosure in openid.php and signon.php example files - Unsafe generation of BlowfishSecret (when not supplied by the user) - Referrer leak when phpinfo is enabled - Use HTTPS for wiki links - Improve SSL certificate handling - Fix full path disclosure in debugging code - Administrators could trigger SQL injection attack against users - Weaknesses with cookie encryption see PMASA-2016-29 (CVE-2016-6606, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-30 (CVE-2016-6607, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-31 (CVE-2016-6608, CWE-661) - PHP code injection see PMASA-2016-32 (CVE-2016-6609, CWE-661) - Full path disclosure see PMASA-2016-33 (CVE-2016-6610, CWE-661) - SQL injection attack see PMASA-2016-34 (CVE-2016-6611, CWE-661) - Local file exposure through LOAD DATA LOCAL INFILE see PMASA-2016-35 (CVE-2016-6612, CWE-661) - Local file exposure through symlinks with UploadDir see PMASA-2016-36 (CVE-2016-6613, CWE-661) - Path traversal with SaveDir and UploadDir see PMASA-2016-37 (CVE-2016-6614, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-38 (CVE-2016-6615, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-39 (CVE-2016-6616, CWE-661) - SQL injection vulnerability see PMASA-2016-40 (CVE-2016-6617, CWE-661) - Denial-of-service attack through transformation feature see PMASA-2016-41 (CVE-2016-6618, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-42 (CVE-2016-6619, CWE-661) - Verify data before unserializing see PMASA-2016-43 (CVE-2016-6620, CWE-661) - SSRF in setup script see PMASA-2016-44 (CVE-2016-6621, CWE-661) - Denial-of-service attack with $cfg[
    last seen2020-06-05
    modified2016-08-30
    plugin id93214
    published2016-08-30
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/93214
    titleopenSUSE Security Update : phpMyAdmin (openSUSE-2016-1027)