Announcement-ID: PMASA-2004-1
Date: 2004-06-29
When faking table with specific name, an attacker can make phpMyAdmin to execute arbitrary php code and add custom server configuration.
phpMyAdmin used eval function to fill some values and one parameter used there was table name. When specifying specially formatted table name, this could lead to eval attacker code. However this requires also a modified MySQL server, that will return these table names, as normally MySQL doesn't allow it. With conjunction to not checking input variables, attacker can make phpMyAdmin use patched MySQL server he wants.
Default configuration is not affected by this issue, it can happen only when $$cfg['LeftFrameLight'] is FALSE. When this condition is met, attacker can execute arbitrary php code which is shipped by his patched MySQL version. If php is running in safe mode or there is firewall not allowing outgoing connections to outside machines, this issue can not cause any harm. As this can cause serious problems, we consider this issue as critical.
All releases starting with 2.5.1 up to and including 2.5.7.
All releases older than 2.5.1. CVS HEAD has been fixed. The upcoming 2.5.7-pl1 release.
If you are vulnerable to this issue, we recommend to enable light left frame mode, which disables eval code. We strongly advise everyone to upgrade to CVS HEAD or to the next version of phpMyAdmin, which is to be released soon.
http://www.securityfocus.com/archive/1/367486
Assigned CVE ids: CVE-2004-2631
For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.