ID CVE-2014-9218
Summary libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource consumption) via a long password.
References
Vulnerable Configurations
  • phpMYAdmin 4.0.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0
  • phpMYAdmin 4.0.0 release candidate 2
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2
  • phpMYAdmin 4.0.0 release candidate 3
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3
  • phpMYAdmin 4.0.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1
  • phpMYAdmin 4.0.10
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10
  • phpMYAdmin 4.0.10.2
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2
  • phpMYAdmin 4.0.10.5
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5
  • phpMYAdmin 4.0.2
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2
  • phpMYAdmin 4.0.3
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3
  • phpMYAdmin 4.0.4
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4
  • phpMYAdmin 4.0.4.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1
  • phpMYAdmin 4.0.4.2
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2
  • phpMYAdmin 4.0.5
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5
  • phpMYAdmin 4.0.6
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6
  • phpMYAdmin 4.0.7
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7
  • phpMYAdmin 4.0.8
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8
  • phpMYAdmin 4.0.9
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9
  • phpMYAdmin 4.1.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0
  • phpMYAdmin 4.1.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1
  • phpMYAdmin 4.1.10
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10
  • phpMYAdmin 4.1.11
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11
  • phpMYAdmin 4.1.12
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12
  • phpMYAdmin 4.1.13
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13
  • phpMYAdmin 4.1.14
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14
  • phpMYAdmin 4.1.14.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1
  • phpMYAdmin 4.1.14.3
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.3
  • phpMYAdmin 4.1.14.6
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.6
  • phpMYAdmin 4.1.2
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2
  • phpMYAdmin 4.1.3
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3
  • phpMYAdmin 4.1.4
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4
  • phpMYAdmin 4.1.5
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5
  • phpMYAdmin 4.1.6
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6
  • phpMYAdmin 4.1.7
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7
  • phpMYAdmin 4.1.8
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8
  • phpMYAdmin 4.1.9
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9
  • phpMYAdmin 4.2.0
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0
  • phpMYAdmin 4.2.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1
  • phpMYAdmin 4.2.11
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.11
  • phpMYAdmin 4.2.12
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.12
  • phpMYAdmin 4.2.13
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.13
  • phpMYAdmin 4.2.10
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10
  • phpMYAdmin 4.2.10.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10.1
  • phpMYAdmin 4.2.2
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2
  • phpMYAdmin 4.2.3
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3
  • phpMYAdmin 4.2.4
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4
  • phpMYAdmin 4.2.5
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5
  • phpMYAdmin 4.2.6
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.6
  • phpMYAdmin 4.2.7
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7
  • phpMYAdmin 4.2.7.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7.1
  • phpMYAdmin 4.2.8
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8
  • phpMYAdmin 4.2.8.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8.1
  • phpMYAdmin 4.2.9
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9
  • phpMYAdmin 4.2.9.1
    cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9.1
CVSS
Base: 5.0 (as of 08-12-2014 - 09:55)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
exploit-db via4
description phpMyAdmin 4.0.x / 4.1.x / 4.2.x - DoS. CVE-2014-9218. Dos exploit for php platform
id EDB-ID:35539
last seen 2016-02-04
modified 2014-12-15
published 2014-12-15
reporter Javer Nieto and Andres Rojas
source https://www.exploit-db.com/download/35539/
title phpMyAdmin 4.0.x / 4.1.x / 4.2.x - DoS
nessus via4
  • NASL family CGI abuses
    NASL id PHPMYADMIN_PMASA_2014_18.NASL
    description According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.7, 4.1.x prior to 4.1.14.8, or 4.2.x prior to 4.2.13.1. It is, therefore, affected by the following vulnerabilities : - A flaw exists in handling overly long passwords. It is possible that a remote attacker can cause a denial of service by using a long password. (CVE-2014-9218) - A cross-site scripting flaw exists due to the improper validation of URLs when handling redirection. A remote attacker, by using a specially crafted request, could execute arbitrary script code within the trust relationship of the browser and server. Note that this applies only to versions 4.2.x prior to 4.2.13.1. (CVE-2014-9219) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 79797
    published 2014-12-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79797
    title phpMyAdmin 4.0.x < 4.0.10.7 / 4.1.x < 4.1.14.8 / 4.2.x < 4.2.13.1 Multiple Vulnerabilities (PMASA-2014-17 - PMASA-2014-18)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2014-243.NASL
    description Multiple vulnerabilities has been discovered and corrected in phpmyadmin : libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource consumption) via a long password (CVE-2014-9218). Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter (CVE-2014-9219). This upgrade provides the latest phpmyadmin version (4.2.13.1) to address these vulnerabilities.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 79988
    published 2014-12-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79988
    title Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2014:243)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2014-16327.NASL
    description phpMyAdmin 4.2.13.1 (2014-12-03) ================================ - [security] XSS vulnerability in redirection mechanism - [security] DOS attack with long passwords Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 79933
    published 2014-12-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79933
    title Fedora 21 : phpMyAdmin-4.2.13.1-1.fc21 (2014-16327)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2014-16358.NASL
    description phpMyAdmin 4.2.13.1 (2014-12-03) ================================ - [security] XSS vulnerability in redirection mechanism - [security] DOS attack with long passwords Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 79936
    published 2014-12-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79936
    title Fedora 20 : phpMyAdmin-4.2.13.1-1.fc20 (2014-16358)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-336.NASL
    description Several issues have been fixed in phpMyAdmin, the web administration tool for MySQL. CVE-2014-8958 Multiple cross-site scripting (XSS) vulnerabilities. CVE-2014-9218 Denial of service (resource consumption) via a long password. CVE-2015-2206 Risk of BREACH attack due to reflected parameter. CVE-2015-3902 XSRF/CSRF vulnerability in phpMyAdmin setup. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-06
    plugin id 86641
    published 2015-10-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=86641
    title Debian DLA-336-1 : phpmyadmin security update
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_C9C46FBF7B8311E4A96E6805CA0B3D42.NASL
    description The phpMyAdmin development team reports : DoS vulnerability with long passwords. With very long passwords it was possible to initiate a denial of service attack on phpMyAdmin. We consider this vulnerability to be serious. This vulnerability can be mitigated by configuring throttling in the webserver. XSS vulnerability in redirection mechanism. With a crafted URL it was possible to trigger an XSS in the redirection mechanism in phpMyAdmin. We consider this vulnerability to be non critical.
    last seen 2019-02-21
    modified 2018-12-19
    plugin id 79734
    published 2014-12-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79734
    title FreeBSD : phpMyAdmin -- XSS and DoS vulnerabilities (c9c46fbf-7b83-11e4-a96e-6805ca0b3d42)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2014-16474.NASL
    description phpMyAdmin 4.2.13.1 (2014-12-03) ================================ - [security] XSS vulnerability in redirection mechanism - [security] DOS attack with long passwords Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 79948
    published 2014-12-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79948
    title Fedora 19 : phpMyAdmin-4.2.13.1-1.fc19 (2014-16474)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3382.NASL
    description Several issues have been fixed in phpMyAdmin, the web administration tool for MySQL. - CVE-2014-8958 (Wheezy only) Multiple cross-site scripting (XSS) vulnerabilities. - CVE-2014-9218 (Wheezy only) Denial of service (resource consumption) via a long password. - CVE-2015-2206 Risk of BREACH attack due to reflected parameter. - CVE-2015-3902 XSRF/CSRF vulnerability in phpMyAdmin setup. - CVE-2015-3903 (Jessie only) Vulnerability allowing man-in-the-middle attack on API call to GitHub. - CVE-2015-6830 (Jessie only) Vulnerability that allows bypassing the reCaptcha test. - CVE-2015-7873 (Jessie only) Content spoofing vulnerability when redirecting user to an external site.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 86665
    published 2015-10-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=86665
    title Debian DSA-3382-1 : phpmyadmin - security update
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-776.NASL
    description phpMyAdmin on openSUSE 12.3 and 13.1 was updated to 4.1.14.8. This update fixes one vulnerability. - Security fixes : - PMASA-2014-17 (CVE-2014-9218, CWE-661 CWE-400) [boo#908363] http://www.phpmyadmin.net/home_page/security/PMASA-2014- 17.php - sf#4611 [security] DOS attack with long passwords phpMyAdmin on openSUSE 13.2 was updated to 4.2.13.1 (2014-12-03) - Security fixes : - PMASA-2014-18 (CVE-2014-9219, CWE-661 CWE-79) [boo#908364] http://www.phpmyadmin.net/home_page/security/PMASA-2014- 18.php - sf#4612 [security] XSS vulnerability in redirection mechanism - PMASA-2014-17 (CVE-2014-9218, CWE-661 CWE-400) [boo#908363] http://www.phpmyadmin.net/home_page/security/PMASA-2014- 17.php - sf#4611 [security] DOS attack with long passwords - Bugfixes : - sf#4604 Query history not being deleted - sf#4057 db/table query string parameters no longer work - sf#4605 Unseen messages in tracking - sf#4606 Tracking report export as SQL dump does not work - sf#4607 Syntax error during db_copy operation - sf#4608 SELECT permission issues with relations and restricted access
    last seen 2019-02-21
    modified 2018-12-18
    plugin id 80049
    published 2014-12-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80049
    title openSUSE Security Update : phpMyAdmin (openSUSE-SU-2014:1636-1)
refmap via4
bid 71434
confirm
debian DSA-3382
mandriva MDVSA-2014:243
xf phpmyadmin-cve20149218-dos(99140)
Last major update 06-12-2016 - 22:01
Published 08-12-2014 - 06:59
Last modified 07-09-2017 - 21:29
Back to Top