Vulnerabilities > CVE-2016-6626 - 7PK - Security Features vulnerability in PHPmyadmin

047910
CVSS 5.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
NONE
network
phpmyadmin
CWE-254
nessus

Summary

An issue was discovered in phpMyAdmin. An attacker could redirect a user to a malicious web page. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

Vulnerable Configurations

Part Description Count
Application
Phpmyadmin
60

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-757.NASL
    descriptionVarious security issues where found and fixed in phpmyadmin in wheezy. CVE-2016-4412 / PMASA-2016-57 A user can be tricked in following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. CVE-2016-6626 / PMASA-2016-49 In the fix for PMASA-2016-57, we didn
    last seen2020-03-17
    modified2016-12-27
    plugin id96093
    published2016-12-27
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/96093
    titleDebian DLA-757-1 : phpmyadmin security update
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-757-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(96093);
      script_version("3.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2016-4412", "CVE-2016-6626", "CVE-2016-9849", "CVE-2016-9850", "CVE-2016-9861", "CVE-2016-9864", "CVE-2016-9865");
    
      script_name(english:"Debian DLA-757-1 : phpmyadmin security update");
      script_summary(english:"Checks dpkg output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Various security issues where found and fixed in phpmyadmin in wheezy.
    
    CVE-2016-4412 / PMASA-2016-57
    
    A user can be tricked in following a link leading to phpMyAdmin, which
    after authentication redirects to another malicious site.
    
    CVE-2016-6626 / PMASA-2016-49
    
    In the fix for PMASA-2016-57, we didn't have sufficient checking and
    was possible to bypass whitelist.
    
    CVE-2016-9849 / PMASA-2016-60
    
    Username deny rules bypass (AllowRoot & Others) by using Null Byte.
    
    CVE-2016-9850 / PMASA-2016-61
    
    Username matching for the allow/deny rules may result in wrong matches
    and detection of the username in the rule due to non-constant
    execution time.
    
    CVE-2016-9861 / PMASA-2016-66
    
    In the fix for PMASA-2016-49, we has buggy checks and was possible to
    bypass whitelist.
    
    CVE-2016-9864 / PMASA-2016-69
    
    Multiple SQL injection vulnerabilities.
    
    CVE-2016-9865 / PMASA-2016-70
    
    Due to a bug in serialized string parsing, it was possible to bypass
    the protection offered by PMA_safeUnserialize() function.
    
    For Debian 7 'Wheezy', these problems have been fixed in version
    4:3.4.11.1-2+deb7u7.
    
    We recommend that you upgrade your phpmyadmin packages.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2016/12/msg00036.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/wheezy/phpmyadmin"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Upgrade the affected phpmyadmin package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:phpmyadmin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/12/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/12/27");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"7.0", prefix:"phpmyadmin", reference:"4:3.4.11.1-2+deb7u7")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyCGI abuses
    NASL idPHPMYADMIN_PMASA_2016_29.NASL
    descriptionAccording to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.17, 4.4.x prior to 4.4.15.8, or 4.6.x prior to 4.6.4. It is, therefore, affected by the following vulnerabilities : - An information disclosure vulnerability exists due to the use of an algorithm that is vulnerable to padding oracle attacks. An unauthenticated, remote attacker can exploit this to decrypt information without the key, resulting in the disclosure of usernames and passwords. (CVE-2016-6606) - A cross-site scripting (XSS) vulnerability exists in the replication_gui.lib.php script due to improper validation of user-supplied input to the
    last seen2020-06-01
    modified2020-06-02
    plugin id95027
    published2016-11-21
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95027
    titlephpMyAdmin 4.0.x < 4.0.10.17 / 4.4.x < 4.4.15.8 / 4.6.x < 4.6.4 Multiple Vulnerabilities (PMASA-2016-29 - PMASA-2016-56)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1821.NASL
    descriptionMultiple security vulnerabilities were fixed in phpmyadmin, a MySQL web administration tool, which prevent possible SQL injection attacks, CSRF, the bypass of user restrictions, information disclosure or denial of service. For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id125957
    published2019-06-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125957
    titleDebian DLA-1821-1 : phpmyadmin security update
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-1021.NASL
    descriptionphpMyAdmin was updated to version 4.4.15.8 (2016-08-16) to fix the following issues : - Upstream changelog for 4.4.15.8 : - Improve session cookie code for openid.php and signon.php example files - Full path disclosure in openid.php and signon.php example files - Unsafe generation of BlowfishSecret (when not supplied by the user) - Referrer leak when phpinfo is enabled - Use HTTPS for wiki links - Improve SSL certificate handling - Fix full path disclosure in debugging code - Administrators could trigger SQL injection attack against users - other fixes - Remove Swekey support - Security fixes: https://www.phpmyadmin.net/security/ - Weaknesses with cookie encryption see PMASA-2016-29 (CVE-2016-6606, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-30 (CVE-2016-6607, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-31 (CVE-2016-6608, CWE-661) - PHP code injection see PMASA-2016-32 (CVE-2016-6609, CWE-661) - Full path disclosure see PMASA-2016-33 (CVE-2016-6610, CWE-661) - SQL injection attack see PMASA-2016-34 (CVE-2016-6611, CWE-661) - Local file exposure through LOAD DATA LOCAL INFILE see PMASA-2016-35 (CVE-2016-6612, CWE-661) - Local file exposure through symlinks with UploadDir see PMASA-2016-36 (CVE-2016-6613, CWE-661) - Path traversal with SaveDir and UploadDir see PMASA-2016-37 (CVE-2016-6614, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-38 (CVE-2016-6615, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-39 (CVE-2016-6616, CWE-661) - SQL injection vulnerability see PMASA-2016-40 (CVE-2016-6617, CWE-661) - Denial-of-service attack through transformation feature see PMASA-2016-41 (CVE-2016-6618, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-42 (CVE-2016-6619, CWE-661) - Verify data before unserializing see PMASA-2016-43 (CVE-2016-6620, CWE-661) - SSRF in setup script see PMASA-2016-44 (CVE-2016-6621, CWE-661) - Denial-of-service attack with $cfg[
    last seen2020-06-05
    modified2016-08-30
    plugin id93212
    published2016-08-30
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/93212
    titleopenSUSE Security Update : phpMyAdmin (openSUSE-2016-1021)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_EF70B201645D11E69CDC6805CA0B3D42.NASL
    descriptionThe phpmyadmin development team reports : Weakness with cookie encryption Multiple XSS vulnerabilities Multiple XSS vulnerabilities PHP code injection Full path disclosure SQL injection attack Local file exposure Local file exposure through symlinks with UploadDir Path traversal with SaveDir and UploadDir Multiple XSS vulnerabilities SQL injection attack SQL injection attack Denial of service (DOS) attack in transformation feature SQL injection attack as control user Unvalidated data passed to unserialize() DOS attack with forced persistent connections Denial of service (DOS) attack by for loops IPv6 and proxy server IP-based authentication rule circumvention Detect if user is logged in Bypass URL redirect protection Referrer leak in url.php Reflected File Download attack ArbitraryServerRegexp bypass Denial of service (DOS) attack by changing password to a very long string Remote code execution vulnerability when run as CGI Summary Denial of service (DOS) attack with dbase extension Remote code execution vulnerability when PHP is running with dbase extension
    last seen2020-06-01
    modified2020-06-02
    plugin id93024
    published2016-08-18
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93024
    titleFreeBSD : phpmyadmin -- multiple vulnerabilities (ef70b201-645d-11e6-9cdc-6805ca0b3d42)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201701-32.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201701-32 (phpMyAdmin: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in phpMyAdmin. Please review the CVE identifiers referenced below for details. Impact : A authenticated remote attacker could exploit these vulnerabilities to execute arbitrary PHP Code, inject SQL code, or to conduct Cross-Site Scripting attacks. In certain configurations, an unauthenticated remote attacker could cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id96426
    published2017-01-12
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96426
    titleGLSA-201701-32 : phpMyAdmin: Multiple vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-1027.NASL
    descriptionThis phpMyAdmin update to version 4.4.15.8 fixes the following issues : Security issues fixed : - Improve session cookie code for openid.php and signon.php example files - Full path disclosure in openid.php and signon.php example files - Unsafe generation of BlowfishSecret (when not supplied by the user) - Referrer leak when phpinfo is enabled - Use HTTPS for wiki links - Improve SSL certificate handling - Fix full path disclosure in debugging code - Administrators could trigger SQL injection attack against users - Weaknesses with cookie encryption see PMASA-2016-29 (CVE-2016-6606, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-30 (CVE-2016-6607, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-31 (CVE-2016-6608, CWE-661) - PHP code injection see PMASA-2016-32 (CVE-2016-6609, CWE-661) - Full path disclosure see PMASA-2016-33 (CVE-2016-6610, CWE-661) - SQL injection attack see PMASA-2016-34 (CVE-2016-6611, CWE-661) - Local file exposure through LOAD DATA LOCAL INFILE see PMASA-2016-35 (CVE-2016-6612, CWE-661) - Local file exposure through symlinks with UploadDir see PMASA-2016-36 (CVE-2016-6613, CWE-661) - Path traversal with SaveDir and UploadDir see PMASA-2016-37 (CVE-2016-6614, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-38 (CVE-2016-6615, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-39 (CVE-2016-6616, CWE-661) - SQL injection vulnerability see PMASA-2016-40 (CVE-2016-6617, CWE-661) - Denial-of-service attack through transformation feature see PMASA-2016-41 (CVE-2016-6618, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-42 (CVE-2016-6619, CWE-661) - Verify data before unserializing see PMASA-2016-43 (CVE-2016-6620, CWE-661) - SSRF in setup script see PMASA-2016-44 (CVE-2016-6621, CWE-661) - Denial-of-service attack with $cfg[
    last seen2020-06-05
    modified2016-08-30
    plugin id93214
    published2016-08-30
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/93214
    titleopenSUSE Security Update : phpMyAdmin (openSUSE-2016-1027)