Vulnerabilities > CVE-2016-6629 - 7PK - Security Features vulnerability in PHPmyadmin
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family CGI abuses NASL id PHPMYADMIN_PMASA_2016_29.NASL description According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.17, 4.4.x prior to 4.4.15.8, or 4.6.x prior to 4.6.4. It is, therefore, affected by the following vulnerabilities : - An information disclosure vulnerability exists due to the use of an algorithm that is vulnerable to padding oracle attacks. An unauthenticated, remote attacker can exploit this to decrypt information without the key, resulting in the disclosure of usernames and passwords. (CVE-2016-6606) - A cross-site scripting (XSS) vulnerability exists in the replication_gui.lib.php script due to improper validation of user-supplied input to the last seen 2020-06-01 modified 2020-06-02 plugin id 95027 published 2016-11-21 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/95027 title phpMyAdmin 4.0.x < 4.0.10.17 / 4.4.x < 4.4.15.8 / 4.6.x < 4.6.4 Multiple Vulnerabilities (PMASA-2016-29 - PMASA-2016-56) NASL family SuSE Local Security Checks NASL id OPENSUSE-2016-1021.NASL description phpMyAdmin was updated to version 4.4.15.8 (2016-08-16) to fix the following issues : - Upstream changelog for 4.4.15.8 : - Improve session cookie code for openid.php and signon.php example files - Full path disclosure in openid.php and signon.php example files - Unsafe generation of BlowfishSecret (when not supplied by the user) - Referrer leak when phpinfo is enabled - Use HTTPS for wiki links - Improve SSL certificate handling - Fix full path disclosure in debugging code - Administrators could trigger SQL injection attack against users - other fixes - Remove Swekey support - Security fixes: https://www.phpmyadmin.net/security/ - Weaknesses with cookie encryption see PMASA-2016-29 (CVE-2016-6606, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-30 (CVE-2016-6607, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-31 (CVE-2016-6608, CWE-661) - PHP code injection see PMASA-2016-32 (CVE-2016-6609, CWE-661) - Full path disclosure see PMASA-2016-33 (CVE-2016-6610, CWE-661) - SQL injection attack see PMASA-2016-34 (CVE-2016-6611, CWE-661) - Local file exposure through LOAD DATA LOCAL INFILE see PMASA-2016-35 (CVE-2016-6612, CWE-661) - Local file exposure through symlinks with UploadDir see PMASA-2016-36 (CVE-2016-6613, CWE-661) - Path traversal with SaveDir and UploadDir see PMASA-2016-37 (CVE-2016-6614, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-38 (CVE-2016-6615, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-39 (CVE-2016-6616, CWE-661) - SQL injection vulnerability see PMASA-2016-40 (CVE-2016-6617, CWE-661) - Denial-of-service attack through transformation feature see PMASA-2016-41 (CVE-2016-6618, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-42 (CVE-2016-6619, CWE-661) - Verify data before unserializing see PMASA-2016-43 (CVE-2016-6620, CWE-661) - SSRF in setup script see PMASA-2016-44 (CVE-2016-6621, CWE-661) - Denial-of-service attack with $cfg[ last seen 2020-06-05 modified 2016-08-30 plugin id 93212 published 2016-08-30 reporter This script is Copyright (C) 2016-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/93212 title openSUSE Security Update : phpMyAdmin (openSUSE-2016-1021) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_EF70B201645D11E69CDC6805CA0B3D42.NASL description The phpmyadmin development team reports : Weakness with cookie encryption Multiple XSS vulnerabilities Multiple XSS vulnerabilities PHP code injection Full path disclosure SQL injection attack Local file exposure Local file exposure through symlinks with UploadDir Path traversal with SaveDir and UploadDir Multiple XSS vulnerabilities SQL injection attack SQL injection attack Denial of service (DOS) attack in transformation feature SQL injection attack as control user Unvalidated data passed to unserialize() DOS attack with forced persistent connections Denial of service (DOS) attack by for loops IPv6 and proxy server IP-based authentication rule circumvention Detect if user is logged in Bypass URL redirect protection Referrer leak in url.php Reflected File Download attack ArbitraryServerRegexp bypass Denial of service (DOS) attack by changing password to a very long string Remote code execution vulnerability when run as CGI Summary Denial of service (DOS) attack with dbase extension Remote code execution vulnerability when PHP is running with dbase extension last seen 2020-06-01 modified 2020-06-02 plugin id 93024 published 2016-08-18 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/93024 title FreeBSD : phpmyadmin -- multiple vulnerabilities (ef70b201-645d-11e6-9cdc-6805ca0b3d42) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201701-32.NASL description The remote host is affected by the vulnerability described in GLSA-201701-32 (phpMyAdmin: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in phpMyAdmin. Please review the CVE identifiers referenced below for details. Impact : A authenticated remote attacker could exploit these vulnerabilities to execute arbitrary PHP Code, inject SQL code, or to conduct Cross-Site Scripting attacks. In certain configurations, an unauthenticated remote attacker could cause a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 96426 published 2017-01-12 reporter This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/96426 title GLSA-201701-32 : phpMyAdmin: Multiple vulnerabilities NASL family SuSE Local Security Checks NASL id OPENSUSE-2016-1027.NASL description This phpMyAdmin update to version 4.4.15.8 fixes the following issues : Security issues fixed : - Improve session cookie code for openid.php and signon.php example files - Full path disclosure in openid.php and signon.php example files - Unsafe generation of BlowfishSecret (when not supplied by the user) - Referrer leak when phpinfo is enabled - Use HTTPS for wiki links - Improve SSL certificate handling - Fix full path disclosure in debugging code - Administrators could trigger SQL injection attack against users - Weaknesses with cookie encryption see PMASA-2016-29 (CVE-2016-6606, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-30 (CVE-2016-6607, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-31 (CVE-2016-6608, CWE-661) - PHP code injection see PMASA-2016-32 (CVE-2016-6609, CWE-661) - Full path disclosure see PMASA-2016-33 (CVE-2016-6610, CWE-661) - SQL injection attack see PMASA-2016-34 (CVE-2016-6611, CWE-661) - Local file exposure through LOAD DATA LOCAL INFILE see PMASA-2016-35 (CVE-2016-6612, CWE-661) - Local file exposure through symlinks with UploadDir see PMASA-2016-36 (CVE-2016-6613, CWE-661) - Path traversal with SaveDir and UploadDir see PMASA-2016-37 (CVE-2016-6614, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-38 (CVE-2016-6615, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-39 (CVE-2016-6616, CWE-661) - SQL injection vulnerability see PMASA-2016-40 (CVE-2016-6617, CWE-661) - Denial-of-service attack through transformation feature see PMASA-2016-41 (CVE-2016-6618, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-42 (CVE-2016-6619, CWE-661) - Verify data before unserializing see PMASA-2016-43 (CVE-2016-6620, CWE-661) - SSRF in setup script see PMASA-2016-44 (CVE-2016-6621, CWE-661) - Denial-of-service attack with $cfg[ last seen 2020-06-05 modified 2016-08-30 plugin id 93214 published 2016-08-30 reporter This script is Copyright (C) 2016-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/93214 title openSUSE Security Update : phpMyAdmin (openSUSE-2016-1027)