PT-2018-6789 · Php+3 · Phpmyadmin+3

Isaac Bennetch · Published 2014-05-05 · Updated 2022-05-13 · CVE-2017-18264

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: phpMyAdmin versions 4.0 through 4.0.10.19 phpMyAdmin version 4.4.x phpMyAdmin version 4.6.x phpMyAdmin version 4.7.0 prereleases

Description: An issue allows the bypassing of restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false under certain PHP versions, such as version 5. This can allow users with no password set to log in, even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword'] to false. The issue occurs due to some implementations of the PHP substr function returning false when given an empty string as the first argument.

Recommendations: For phpMyAdmin versions 4.0 through 4.0.10.19, update to version 4.0.10.20 or later. For phpMyAdmin version 4.4.x, update to a version outside of the 4.4.x range. For phpMyAdmin version 4.6.x, update to a version outside of the 4.6.x range. For phpMyAdmin version 4.7.0 prereleases, update to a release version of 4.7.0 or later.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

ALT-PU-2014-1591

ALT-PU-2017-1604

CVE-2017-18264

DLA-1415-1

GHSA-5868-G58J-VRJ5

USN-4843-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Phpmyadmin

References · 136

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmyadmin_null_termination_exec.rb · Exploit
• 🔥 https://github.com/coffeehb/Some-PoC-oR-ExP/blob/master/PhpMyAdmin/phpmyadmin4.6.2_RCE.py · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-18264 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5701 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9847 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6632 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5731 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8669 · Security Note
• https://phpmyadmin.net/security/PMASA-2017-8 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9218 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4843-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000014 · Security Note
• https://ubuntu.com/security/CVE-2016-6609 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6619 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18264 · Security Note