The vulnerabilities affect all versions of phpMyAdmin prior to 220.127.116.11 and 18.104.22.168, according to an advisory from Secunia.
phpMyAdmin is a widely used software tool that handles the administration of one or more MySQL servers over the web.
- An error within the "Swekey_login()" function in libraries/auth/swekey/swekey.auth.lib.php can be exploited to overwrite session variables and e.g. inject and execute arbitrary PHP code.
- Input passed to the "PMA_createTargetTables()" function in libraries/server_synchronize.lib.php is not properly sanitised before calling the "preg_replace()" function with the "e" modifier. This can be exploited to execute arbitrary PHP code via URL-encoded NULL bytes.
- Input passed to the "PMA_displayTableBody()" function in libraries/display_tbl.lib.php is not properly sanitised before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal sequences.
Secunia said a weakness in setup scripts, which could lead to arbitrary PHP code injection if session variables are overwritten, was also addressed.
phpMyAdmin users are urged to immediately update to version 22.214.171.124 or 126.96.36.199.