phpMyAdmin vulnerabilities

phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a DoS attack in the replication status by using a specially crafted table name.

phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a weakness that allows a user with appropriate permissions to connect to an arbitrary MySQL server.

phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a DoS weakness in the table editing functionality.

The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.

An issue was discovered in phpMyAdmin that allows SQL injection via a crafted username or table name in the tracking functionality. The executed statements run with the privileges of the control user, granting access to configuration storage database tables and, if the control user has the necessary privileges, to some MySQL database tables.

An issue was discovered in phpMyAdmin that allows for a Denial of Service (DoS) attack through a very large request to the table partitioning function. All 4.6.x versions prior to 4.6.5 are affected.

An issue was discovered in phpMyAdmin that allows for BBCode injection on the login page via a crafted login request. All 4.6.x versions (prior to 4.6.5) are affected.

An issue was discovered in phpMyAdmin related to the limitation in URL matching, allowing for the bypass of URL white-list protection. This affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18).

An issue was discovered in phpMyAdmin that can lead to remote code execution in certain PHP installations running with the dbase extension. This affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).

An issue was discovered in phpMyAdmin that allows for remote code execution when the application is run as CGI. A user can pass a query string that is executed as a command-line argument by the file generator_plugin.sh.

An issue was discovered in phpMyAdmin allowing for SQL injection attacks through the user interface preference feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

An issue was discovered in phpMyAdmin that allows for an SQL injection attack through the export functionality by using a specially crafted database and/or table name. All 4.6.x versions prior to 4.6.4 are affected.

An issue was discovered in phpMyAdmin that allows for an SQL injection attack in the 'User group' and 'Designer' features. An attacker can exploit this vulnerability against the control user account. Affects versions 4.6.x (prior to 4.6.4) and 4.4.x (prior to 4.4.15.8).

An issue was discovered in phpMyAdmin that allows for an SQL injection attack through a specially crafted database and/or table name in the export functionality. This affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).

An issue was discovered in phpMyAdmin that allows arbitrary PHP commands to be executed through a specially crafted database name in the array export feature. This affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).

An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack, allowing an attacker with access to a user's browser cookie file to decrypt these credentials.

The Transformation implementation in phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, making it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header.

In phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3, a vulnerability allows remote attackers to cause a denial of service via a large array in the scripts parameter.

In phpMyAdmin versions 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4, there is a vulnerability related to the comparison of CSRF tokens that does not use a constant-time algorithm. This allows remote attackers to bypass intended access restrictions by measuring time differences.

The suggestPassword function in phpMyAdmin before version 4.0.10.13, 4.4.15.3, and 4.5.4 relies on the Math.random JavaScript function, making it easier for remote attackers to guess passwords via a brute-force approach.

SQL Injection vulnerability in phpMyAdmin 5.x before 5.2.0, located in the getTableCreationQuery function in CreateAddField.php. An attacker can inject malicious SQL queries via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.

An issue was discovered in phpMyAdmin related to improper stripping of the CSRF token from the return URL of the preference import action when the arg_separator is different from its default '&' value. This affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18).

An issue was discovered in phpMyAdmin due to a bug in serialized string parsing, allowing bypass of the protection offered by the PMA_safeUnserialize() function.

An issue was discovered in phpMyAdmin that allows bypassing the AllowRoot restriction and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp.

An issue was discovered in phpMyAdmin related to the PHP unserialize() function, which does not verify the validity of data before deserialization. This can lead to code execution due to the interaction with object instantiation and autoloading.

phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 do not properly choose delimiters, which may allow remote attackers to execute arbitrary PHP code via a crafted string.

In phpMyAdmin versions 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3, there is an SQL injection vulnerability in libraries/central_columns.lib.php. Remote attackers can execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.