phpMyAdmin 5.2.3 - High - Remote - SQLi - Designer JSON unsanitized identifiers
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · phpmyadmin-designer-json-sqli
Class: SQLi Reach: Remote
phpMyAdmin 5.2.3 (tag RELEASE_5_2_3, commit 962857e). Designer AJAX save_setting_value json_encodes the settings blob and concatenates it into a single-quoted UPDATE/INSERT on the control-user link. Username is escaped. The JSON is not. json_encode does not escape a single quote.
A signed-in user POSTs index.php?route=/database/designer with operation=save_setting_value and a quote in value. queryAsControlUser then runs that string as the pma control user against pma__designer_settings. That account is configuration storage, not the logged-in SQL box. phpMyAdmin 6.x wraps this blob in quoteString on ControlUser. 5.2.3 still raw-concats it.
Older designer CVEs (2016-6616, 2019-11768, 2019-18622) were username / database name. This leftover is the JSON settings_data column.
| ID | no CVE yet |
| Class | SQLi (control-user on pma__designer_settings) |
| Reach | Remote (authenticated cookie login; Designer + pma__designer_settings enabled) |
| CWE | CWE-89 |
| CVSS | High: 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Product | phpMyAdmin |
| Affected | 5.2.3 tag RELEASE_5_2_3 (962857e) |
| Auth | Authenticated cookie login. Designer + pma__designer_settings enabled. |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1:19220 only |
A signed-in phpMyAdmin user who can open Designer can inject SQL as the control user on pma__designer_settings.
| Privilege | Method / path | Lab-proven or inferred |
|---|---|---|
| Break the control-user UPDATE/INSERT string (integrity of pmadb SQL) | POST index.php?route=/database/designer operation=save_setting_value with a quote in value | Lab-proven. General log: SET settings_data = '{"snap_line":"PMA-DESIGNER-JSON-SQLI-WITNESS'#" }' raw. quoteString absent |
Truncate own settings_data so it is no longer JSON (integrity of own row) | Same POST; # comments out the rest of the statement | Lab-proven. appuser blob contains the witness and is not valid JSON. Clean save grid-ok is gone |
| Overwrite other users' designer rows without stacked queries (integrity of victim row) | Same # comments out WHERE username = '...' | Lab-proven. Seed victim {"keep":"safe"} became the truncated witness blob |
| Extra statements as the control user | Same sink if the control mysqli link allows multi-query | Inferred. Default mysqli::query is single-statement. Not enabled here |
Reach other pmadb tables (bookmarks, history, pma__userconfig) | Only if stacked queries or a write-style breakout is possible | Inferred. Control user in this lab has only phpmyadmin.* DML |
Closed on this lab: unauthenticated access, the signed-in appuser SQL box (appdb only; appuser has no GRANT on phpmyadmin), OS shell, and stacked queries. Feature no-ops if pmadb / designer settings is off (that is a FAIL, not this leftover).
Eight parallel source hunts of RELEASE_5_2_3. saveSetting concatenates json_encode into '...'. Username is escapeString. 6.x already quoteStrings this blob. 5.2.3 does not.
Wrong turns: injecting on username (it is escaped); expecting a #1064 (the # comments out the rest, so MySQL accepts the truncated UPDATE); treating stacked queries as proven (mysqli default is single-statement).
python3 phpmyadmin-designer-json-sqli-Abraxas-Labs.py
or
cd lab
./run.sh
Loopback only: http://127.0.0.1:19220. Images phpmyadmin:5.2.3 and mysql:8.0. Compose project phpmyadmin-designer-json-sqli. Witness PMA-DESIGNER-JSON-SQLI-WITNESS.
SUCCESS phpmyadmin-designer-json-sqli version=5.2.3 how=live raw-concat=yes truncated=true sql-error=false quoteString=no PMA-DESIGNER-JSON-SQLI-WITNESS
quoteString(..., ControlUser) / escapeString on the JSON blob, same as RecentFavoriteTable::saveToDb() and phpMyAdmin 6.x on this column. Do not put json_encode output inside a single-quoted SQL literal.
962857e)libraries/classes/Database/Designer/Common.php saveSettingControllers/Database/DesignerController.php POST operation=save_setting_valueGET|POST /database/designerGNU Affero GPL v3.0. See LICENSE. Loopback lab only. No warranty.