phpMyAdmin 5.2.3 - High - Remote - SQLi - auth plugin identifier unquoted
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · phpmyadmin-auth-plugin-unquoted
Class: SQLi Reach: Remote
phpMyAdmin 5.2.3 (RELEASE_5_2_3 / 962857e) - phpMyAdmin
Change password is on by default. UserPassword.php copies POST authentication_plugin into ALTER USER ... IDENTIFIED WITH with no allowlist and no quoting. Username, host, and password in the same statement go through escapeString. On MySQL 8 the WITH clause is emitted when the posted plugin differs from the current one.
A signed-in phpMyAdmin user injects SQL into their own ALTER USER through the change-password form. Extra SQL in the plugin field is SQL, not a plugin name.
| ID | no CVE yet |
| Class | SQLi |
| Reach | Remote (authenticated cookie login; change password on) |
| CWE | CWE-89 |
| CVSS | High: 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Product | phpMyAdmin |
| Affected | 5.2.3 tag RELEASE_5_2_3 (962857e4f63d42e38f11ff4d63f5e722018add76) |
| Auth | authenticated cookie login. $cfg['ShowChgPassword'] default true. Auth type is not config |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
A signed-in phpMyAdmin user can inject SQL into their own ALTER USER through the change-password form.
| Privilege | Method / sink | Recon / integrity / availability | Lab-proven or inferred |
|---|---|---|---|
Send extra SQL in IDENTIFIED WITH | POST index.php?route=/user-password with authentication_plugin | Integrity of the statement phpMyAdmin builds | Lab-proven. Raw POST sha256_password /*PMA-AUTH-PLUGIN-UNQUOTED-WITNESS*/ appears unquoted in the SQL box |
| Have MySQL parse that extra SQL as SQL | Same statement reaches mysqld | Integrity of the user connection | Lab-proven. General log kept plugin sha256_password and dropped the comment. 1227 because this user has no CREATE USER |
| Extra clauses or extra accounts if the breakout parses | Same sink; stacked queries depend on the driver | Integrity of other accounts | Inferred. This lab does not run a second statement or create another account |
| Same concat on add/edit user | Privileges.php IDENTIFIED WITH / MariaDB VIA | Integrity of grantor-built statements | Inferred sibling. Lab POST is change-password only |
Closed on this path: unauthenticated use (cookie login required), config-auth (change password is hidden), RCE, GRANT-less plugin change succeeding on MySQL 8 (1227 without CREATE USER). Username, host, and password stay escaped. Own-password does not need GRANT; the leftover is the unquoted plugin field, not a free plugin swap.
Same pin: WebAuthn CustomServer leftover.
I pinned phpmyadmin/phpmyadmin RELEASE_5_2_3. PMASA-2025-1/2/3 are already in 5.2.2. Change password still builds:
return 'ALTER USER \'' . $dbi->escapeString($username)
. '\'@\'' . $dbi->escapeString($hostname)
. '\' IDENTIFIED WITH ' . $authPlugin . ' BY '
$authPlugin is $_POST['authentication_plugin']. MySQL 5.7.37+ and 8.0 omit WITH unless the plugin changed. POST a different name and the clause comes back.
Wrong turns already recorded: treating MySQL 1227 as failure of the leftover (it is the proof extra SQL parsed); claiming a GRANT-less plugin change on MySQL 8; treating config-auth as in-scope; a reverse shell. Theatre.
python3 phpmyadmin-auth-plugin-unquoted-Abraxas-Labs.py
# or: cd lab && ./run.sh
Target only http://127.0.0.1:19260. Images phpmyadmin:5.2.3 and mysql:8.0. Compose project phpmyadmin-auth-plugin-unquoted. Stack tears down after the run.
Cookie login as appuser. POST /user-password with authentication_plugin=sha256_password /*PMA-AUTH-PLUGIN-UNQUOTED-WITNESS*/. PMA SQL query box: ALTER USER 'appuser'@'%' IDENTIFIED WITH sha256_password /*PMA-AUTH-PLUGIN-UNQUOTED-WITNESS*/ BY '***'. MySQL general log parses the comment and stores IDENTIFIED WITH 'sha256_password'. Username is quoted.
SUCCESS phpmyadmin-auth-plugin-unquoted how=live unquoted=yes escaped-user=yes plugin=sha256_password PMA-AUTH-PLUGIN-UNQUOTED-WITNESS
Allowlist plugin names from SHOW PLUGINS. Never interpolate POST into IDENTIFIED WITH, VIA, or plugin=.
962857e4f63d42e38f11ff4d63f5e722018add76)libraries/classes/UserPassword.phplibraries/classes/Server/Privileges.phpGNU Affero GPL v3.0. See LICENSE. Loopback lab only. No warranty.