exploit the possibilities

phpMyAdmin 3.3.5 / 2.11.10 Cross Site Scripting

phpMyAdmin 3.3.5 / 2.11.10 Cross Site Scripting
Posted Aug 21, 2010
Authored by Aung Khant | Site yehg.net

phpMyAdmin versions 3.3.5 and below and 2.11.10 and below suffer from cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
MD5 | dde94dbb89fb337e02a3932d0f9c4103

phpMyAdmin 3.3.5 / 2.11.10 Cross Site Scripting

Change Mirror Download
==============================================================================
phpMyAdmin 3.3.5 / 2.11.10 <= Cross Site Scripting (XSS) Vulnerability
==============================================================================


1. OVERVIEW

The phpMyAdmin web application was vulnerable to Cross Site Scripting
vulnerability.


2. PRODUCT DESCRIPTION

phpMyAdmin is a free software tool written in PHP intended to handle
the administration of MySQL over the World Wide Web.
phpMyAdmin supports a wide range of operations with MySQL.
The most frequently used operations are supported by the user
interface (managing databases, tables, fields, relations,
indexes, users, permissions, etc), while you still have the ability to
directly execute any SQL statement.


3. VULNERABILITY DESCRIPTION

Some URLs in phpMyAdmin do not properly escape user inputs that lead
to cross site scripting vulnerability.
For more information about this kind of vulnerability, see OWASP Top
10 - A2, WASC-8 and
CWE-79: Improper Neutralization of Input During Web Page Generation
('Cross-site Scripting').


4. VERSIONS AFFECTED

phpMyAdmin 3.3.5 and lower
phpMyAdmin 2.11.10 and lower


5. PROOF-OF-CONCEPT/EXPLOIT

http://yehg.net/lab/pr0js/advisories/phpmyadmin/3.3.5/xss/db_sql.php-01.jpg
http://yehg.net/lab/pr0js/advisories/phpmyadmin/3.3.5/xss/db_sql.php-02.jpg
http://yehg.net/lab/pr0js/advisories/phpmyadmin/3.3.5/xss/db_structure.php-01.jpg
http://yehg.net/lab/pr0js/advisories/phpmyadmin/3.3.5/xss/db_structure.php-02.jpg
http://yehg.net/lab/pr0js/advisories/phpmyadmin/3.3.5/xss/server_databases.php-01.jpg
http://yehg.net/lab/pr0js/advisories/phpmyadmin/3.3.5/xss/server_databases.php-02.jpg
http://yehg.net/lab/pr0js/advisories/phpmyadmin/3.3.5/xss/server_privileges.php-01.jpg
http://yehg.net/lab/pr0js/advisories/phpmyadmin/3.3.5/xss/server_privileges.php-02.jpg
http://yehg.net/lab/pr0js/advisories/phpmyadmin/3.3.5/xss/sql.php-01.jpg
http://yehg.net/lab/pr0js/advisories/phpmyadmin/3.3.5/xss/sql.php-02.jpg

And full list of URLs (of both <probably> unexploitable/exploitable)
that fail to html escape user inputs:

UR: http://target/phpmyadmin/db_search.php
Affected Parameter(s): field_str

URL: http://target/phpmyadmin/db_sql.php
Affected Parameter(s): QUERY_STRING, delimiter

URL: http://target/phpmyadmin/db_structure.php
Affected Parameter(s): sort

URL: http://target/phpmyadmin/js/messages.php
Affected Parameter(s): db

URL: http://target/phpmyadmin/server_databases.php
Affected Parameter(s): sort_by

URL: http://target/phpmyadmin/server_privileges.php
Affected Parameter(s): QUERY_STRING, checkprivs, dbname,
pred_tablename, selected_usr[], tablename , username

URL: http://target/phpmyadmin/setup/config.php
Affected Parameter(s): DefaultLang

URL: http://target/phpmyadmin/sql.php
Affected Parameter(s): QUERY_STRING, cpurge, goto,purge,purgekey,table,zero_rows

URL: http://target/phpmyadmin/tbl_replace.php
Affected (Dynamic) Parameter(s):
fields[multi_edit][0][f7235a61fdc3adc78d866fd8085d44db],
fields_name[multi_edit][0][349e686330723975502e9ef4f939a5ac]


6. IMPACT

Attackers can compromise currently logged-in user session and inject
arbitrary SQL statements (CREATE,INSERT,UPDATE,DELETE)
via crafted XSS payloads.


7. SOLUTION

Upgrade to phpMyAdmin 3.3.5.1 or 2.11.10.1


8. VENDOR

phpMyAdmin (http://www.phpmyadmin.net)


9. CREDIT

This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
Ethical Hacker Group, Myanmar.


10. DISCLOSURE TIME-LINE

08-09-2010: vulnerability discovered
08-10-2010: notified vendor
08-20-2010: vendor released fix
08-20-2010: vulnerability disclosed


11. REFERENCES

Vendor Advisory URL:
http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php
Original Advisory URL:
http://yehg.net/lab/pr0js/advisories/phpmyadmin/[phpmyadmin-3.3.5]_cross_site_scripting(XSS)
Previous Release: http://www.phpmyadmin.net/home_page/security/PMASA-2008-6.php
XSS FAQ: http://www.cgisecurity.com/xss-faq.html
OWASP Top 10: http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
CWE-79: http://cwe.mitre.org/data/definitions/79.html


#yehg [08-20-2010]



---------------------------------
Best regards,
YGN Ethical Hacker Group
Yangon, Myanmar
http://yehg.net
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

October 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    24 Files
  • 2
    Oct 2nd
    15 Files
  • 3
    Oct 3rd
    7 Files
  • 4
    Oct 4th
    4 Files
  • 5
    Oct 5th
    10 Files
  • 6
    Oct 6th
    1 Files
  • 7
    Oct 7th
    21 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    5 Files
  • 10
    Oct 10th
    20 Files
  • 11
    Oct 11th
    17 Files
  • 12
    Oct 12th
    4 Files
  • 13
    Oct 13th
    4 Files
  • 14
    Oct 14th
    15 Files
  • 15
    Oct 15th
    19 Files
  • 16
    Oct 16th
    19 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close