ID CVE-2011-2505
Summary libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a "remote variable manipulation vulnerability."
References
Vulnerable Configurations
  • phpMYAdmin 3.0.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0
  • phpMYAdmin 3.0.0 alpha
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha
  • phpMYAdmin 3.0.0 beta
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta
  • phpMYAdmin 3.0.0 release candidate 1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1
  • phpMYAdmin 3.0.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1
  • phpMYAdmin 3.0.1 release candidate 1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1
  • phpMYAdmin 3.0.1.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1
  • phpMYAdmin 3.1.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0
  • phpMYAdmin 3.1.0 beta1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1
  • phpMYAdmin 3.1.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1
  • phpMYAdmin 3.1.1 release candidate 1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1
  • phpMYAdmin 3.1.2
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2
  • phpMYAdmin 3.1.2 release candidate 1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1
  • phpMYAdmin 3.1.3
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3
  • phpMYAdmin 3.1.3 release candidate 1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1
  • phpMYAdmin 3.1.3.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1
  • phpMYAdmin 3.1.3.2
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2
  • phpMYAdmin 3.1.4
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4
  • phpMYAdmin 3.1.4 release candidate 2
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2
  • phpMYAdmin 3.1.5
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5
  • phpMYAdmin 3.1.5 release candidate 1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1
  • phpMYAdmin 3.2.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0
  • phpMYAdmin 3.2.0 beta1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1
  • phpMYAdmin 3.2.0 release candidate 1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1
  • phpMYAdmin 3.2.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1
  • phpMYAdmin 3.2.1 release candidate 1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1
  • phpMYAdmin 3.2.2
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2
  • phpMYAdmin 3.2.2 release candidate 1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1
  • phpMYAdmin 3.3.0.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0
  • phpMYAdmin 3.3.1.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0
  • phpMYAdmin 3.3.2.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0
  • phpMYAdmin 3.3.3.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0
  • phpMYAdmin 3.3.4.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0
  • phpMYAdmin 3.3.5.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0
  • phpMYAdmin 3.3.5.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1
  • phpMYAdmin 3.3.6
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6
  • phpMYAdmin 3.3.7
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7
  • phpMYAdmin 3.3.8
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8
  • phpMYAdmin 3.3.8.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1
  • phpMYAdmin 3.3.9.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0
  • phpMYAdmin 3.3.9.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1
  • phpMYAdmin 3.3.9.2
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.2
  • phpMYAdmin 3.3.10.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.0
  • phpMYAdmin 3.3.10.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.1
  • phpMYAdmin 3.4.0.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0
  • phpMYAdmin 3.4.1.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0
  • phpMYAdmin 3.4.2.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0
  • phpMYAdmin 3.4.3.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0
CVSS
Base: 6.4 (as of 15-07-2011 - 10:04)
Impact:
Exploitability:
CWE CWE-94
CAPEC
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating User-Controlled Variables
    This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL PARTIAL
d2sec via4
name Phpmyadmin 3.x RCE
url http://www.d2sec.com/exploits/phpmyadmin_3.x_rce.html
exploit-db via4
  • description phpMyAdmin 3.x Swekey Remote Code Injection Exploit. CVE-2011-2505,CVE-2011-2506. Webapps exploit for php platform
    file exploits/php/webapps/17514.php
    id EDB-ID:17514
    last seen 2016-02-02
    modified 2011-07-09
    platform php
    port
    published 2011-07-09
    reporter Mango
    source https://www.exploit-db.com/download/17514/
    title phpMyAdmin 3.x Swekey Remote Code Injection Exploit
    type webapps
  • description phpMyAdmin3 (pma3) Remote Code Execution Exploit. CVE-2011-2505,CVE-2011-2506. Webapps exploit for php platform
    id EDB-ID:17510
    last seen 2016-02-02
    modified 2011-07-08
    published 2011-07-08
    reporter wofeiwo
    source https://www.exploit-db.com/download/17510/
    title phpMyAdmin3 pma3 Remote Code Execution Exploit
nessus via4
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201201-01.NASL
    description The remote host is affected by the vulnerability described in GLSA-201201-01 (phpMyAdmin: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in phpMyAdmin. Please review the CVE identifiers and phpMyAdmin Security Advisories referenced below for details. Impact : Remote attackers might be able to insert and execute PHP code, include and execute local PHP files, or perform Cross-Site Scripting (XSS) attacks via various vectors. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 57433
    published 2012-01-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=57433
    title GLSA-201201-01 : phpMyAdmin: Multiple vulnerabilities
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2286.NASL
    description Several vulnerabilities were discovered in phpMyAdmin, a tool to administrate MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-2505 Possible session manipulation in Swekey authentication. - CVE-2011-2506 Possible code injection in setup script, in case session variables are compromised. - CVE-2011-2507 Regular expression quoting issue in Synchronize code. - CVE-2011-2508 Possible directory traversal in MIME-type transformation. - CVE-2011-2642 Cross site scripting in table Print view when the attacker can create crafted table names. - No CVE name yet Possible superglobal and local variables manipulation in Swekey authentication. (PMASA-2011-12) The oldstable distribution (lenny) is only affected by CVE-2011-2642, which has been fixed in version 2.11.8.1-5+lenny9.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 55708
    published 2011-07-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=55708
    title Debian DSA-2286-1 : phpmyadmin - several vulnerabilities
  • NASL family CGI abuses
    NASL id PHPMYADMIN_PMASA_2011_8.NASL
    description The remote host contains a version of phpMyAdmin - 3.3.x less than 3.3.10.2 or 3.4.x less than 3.4.3.1 - that is affected by multiple vulnerabilities : - An error in the file 'libraries/auth/swekey/swekey.auth.lib.php' allows an attacker to modify the 'SESSION' superglobal array. (CVE-2011-2505) - An error in the file 'setup/lib/ConfigGenerator.class.php' does not properly handle PHP comment-closing delimiters. This can allow an attacker inject static code via a modified 'SESSION' superglobal array. (CVE-2011-2506) - An error in the file 'libraries/server_synchronize.lib.php' does not properly call the 'preg_replace' function. This can allow an attacker to execute arbitrary code via a modified 'SESSION' superglobal array. (CVE-2011-2507) - An local file inclusion error exists in the 'PMA_displayTableBody' function in the file 'libraries/display_tbl.lib.php' that can allow an attacker to obtain sensitive information or execute code in file already present on the host. (CVE-2011-2508)
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 57346
    published 2011-12-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=57346
    title phpMyAdmin 3.3.x / 3.4.x < 3.3.10.2 / 3.4.3.1 Multiple Vulnerabilities (PMASA-2011-5 - PMASA-2011-8)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_7E4E5C53A56C11E0B18000216AA06FC2.NASL
    description The phpMyAdmin development team reports : It was possible to manipulate the PHP session superglobal using some of the Swekey authentication code. This could open a path for other attacks. An unsanitized key from the Servers array is written in a comment of the generated config. An attacker can modify this key by modifying the SESSION superglobal array. This allows the attacker to close the comment and inject code. Through a possible bug in PHP running on Windows systems a NULL byte can truncate the pattern string allowing an attacker to inject the /e modifier causing the preg_replace function to execute its second argument as PHP code. Fixed filtering of a file path in the MIME-type transformation code, which allowed for directory traversal.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 55502
    published 2011-07-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=55502
    title FreeBSD : phpmyadmin -- multiple vulnerabilities (7e4e5c53-a56c-11e0-b180-00216aa06fc2)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2011-9144.NASL
    description Changes for 3.4.3.1 (2011-06-07) - [PMASA-2011-5] Possible session manipulation in Swekey authentication (http://www.phpmyadmin.net/home_page/security/PMASA-2011 -5.php) - [PMASA-2011-6] Possible code injection in setup script in case session variables are compromised (http://www.phpmyadmin.net/home_page/security/PMASA-20 11-6.php) - [PMASA-2011-7] Regular expression quoting issue in Synchronize code (http://www.phpmyadmin.net/home_page/security/PMASA-20 11-7.php) - [PMASA-2011-8] Possible directory traversal (http://www.phpmyadmin.net/home_page/security/PMASA-20 11-8.php) Changes for 3.4.3.0 (2011-06-27) - [sync] Missing helper icons in Synchronize - [setup] Redefine a lable that was wrong - [parser] master is not a reserved word - [edit] Inline edit updates multiple duplicate rows - [edit] Inline edit does not escape backslashes - [interface] Columns class sometimes changed for nothing - [interface] Some tooltips do not disappear - [search] Fix search in non unicode tables - [display] Inline query edit broken - [privileges] Generate password option missing on new accounts - [edit] Inline edit places HTML line breaks in edit area - [interface] Inline query edit does not escape special characters - [security] minor XSS (require a valid token) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 55604
    published 2011-07-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=55604
    title Fedora 14 : phpMyAdmin-3.4.3.1-1.fc14 (2011-9144)
packetstorm via4
refmap via4
bugtraq 20110707 phpMyAdmin 3.x Multiple Remote Code Executions
confirm
debian DSA-2286
exploit-db 17514
fedora FEDORA-2011-9144
mandriva MDVSA-2011:124
misc
mlist
  • [oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities
  • [oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities
  • [oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities
  • [oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities
osvdb 73611
secunia
  • 45139
  • 45292
  • 45315
sreason 8306
the hacker news via4
id THN:4D010FAF46F8DECDF22AE08BD5AA6962
last seen 2017-01-08
modified 2013-09-10
published 2013-09-09
reporter Mohit Kumar
source http://thehackernews.com/2013/09/thanks-to-php-superglobal-80-websites.html
title Web Application Security : PHP SuperGlobal Variables are vulnerable to Hackers
Last major update 25-10-2011 - 22:59
Published 14-07-2011 - 19:55
Last modified 09-10-2018 - 15:32
Back to Top