FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

phpmyadmin -- SQL injection vulnerability

Affected packages
phpMyAdmin < 2.11.5

Details

VuXML ID ce2f2ade-e7df-11dc-a701-000bcdc1757a
Discovery 2008-03-01
Entry 2008-03-04
Modified 2010-05-12

A phpMyAdmin security announcement report:

phpMyAdmin used the $_REQUEST superglobal as a source for its parameters, instead of $_GET and $_POST. This means that on most servers, a cookie with the same name as one of phpMyAdmin's parameters can interfere.

Another application could set a cookie for the root path "/" with a "sql_query" name, therefore overriding the user-submitted sql_query because by default, the $_REQUEST superglobal imports first GET, then POST then COOKIE data.

Mitigation factor

An attacker must trick the victim into visiting a page on the same web server where he has placed code that creates a malicious cookie.

References

Bugtraq ID 28068
CVE Name CVE-2008-1149
URL http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1