abraxas/phpmyadmin-pmadb-central-sqliphpMyAdmin 5.2.3 - High - Remote - SQLi - central columns pmadb query leftover
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · phpmyadmin-pmadb-central-sqli
Class: SQLi Reach: Remote
phpMyAdmin 5.2.3 (tag RELEASE_5_2_3, commit 962857e). Central columns writes col_extra by concatenating POST extra and attribute into a single-quoted SQL literal on the control-user link. Neighboring fields go through escapeString. These two do not.
A signed-in user POSTs index.php?route=/database/central-columns with multi_edit_central_column_save=1 and a quote in field_attribute (or col_extra). getInsertQuery / updateOneColumn then run that string as the pma control user against pma__central_columns. That account is the configuration-storage user, not the logged-in SQL box.
CVE-2016-5703 was the database name in central columns. These extra and attribute fields were not that bug.
| ID | no CVE yet |
| Class | SQLi (control-user on pma__central_columns) |
| Reach | Remote (authenticated cookie login; pmadb central columns enabled) |
| CWE | CWE-89 |
| CVSS | High: 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Product | phpMyAdmin |
| Affected | 5.2.3 tag RELEASE_5_2_3 (962857e) |
| Auth | Authenticated cookie login. pmadb central columns enabled. |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1:19210 only |
A signed-in phpMyAdmin user who can open Central columns can inject SQL as the control user on pma__central_columns.
| Privilege | Method / path | Lab-proven or inferred |
|---|---|---|
| Break the control-user INSERT/UPDATE string (integrity of pmadb SQL) | POST index.php?route=/database/central-columns multi_edit_central_column_save=1 with a quote in field_attribute / col_extra | Lab-proven. #1064 JSON error. Witness PMA-PMADB-CENTRAL-SQLI-WITNESS in the control-user error |
| Keep neighboring fields in-band | Same POST, quote in field_name | Lab-proven. Row stored as neg'col. escapeString held |
| Read or overwrite other users' central-column rows | Same sink, once the string is closed | Inferred. Lab stops at syntax error; no stacked query |
| Extra statements as the control user | Same sink if the control mysqli link allows multi-query | Inferred. Default mysqli::query is single-statement. Not enabled here |
Reach other pmadb tables (bookmarks, history, pma__userconfig) | Only if stacked queries or a INTO-style write is possible | Inferred. Control user in this lab has only phpmyadmin.* DML |
Closed on this lab: unauthenticated access, the signed-in appuser SQL box (appdb only), OS shell, and stacked queries. Feature no-ops if pmadb / central columns is off (that is a FAIL, not this leftover).
Eight parallel source hunts of RELEASE_5_2_3. Neighboring fields in CentralColumns.php are escapeString'd. Extra and attribute are implode into a single-quoted literal. CVE-2016-5703 was the database name, not these columns.
Wrong turns: treating a quote in field_name as the leftover (it stores as neg'col; that is the negative); expecting the general log to show the unescaped witness (the INSERT dies with #1064 before a successful write); treating pmadb-off as this leftover (feature no-ops).
python3 phpmyadmin-pmadb-central-sqli-Abraxas-Labs.py
or
cd lab
./run.sh
Loopback only: http://127.0.0.1:19210. Images phpmyadmin:5.2.3 and mysql:8.0. Compose project phpmyadmin-pmadb-central-sqli. Witness PMA-PMADB-CENTRAL-SQLI-WITNESS.
SUCCESS phpmyadmin-pmadb-central-sqli how=live insert-syntax=yes field-name-escaped=yes general-log-unescaped=false error-has-witness=true PMA-PMADB-CENTRAL-SQLI-WITNESS
escapeString / quoteString(..., CONNECT_CONTROL) on extra and attribute. Allowlist auto_increment, UNSIGNED, BINARY, UNSIGNED ZEROFILL, and on update CURRENT_TIMESTAMP. phpMyAdmin 6.x quoteString on the designer JSON blob is the patched shape for this class of pmadb concat.
962857e)libraries/classes/Database/CentralColumns.php getInsertQuery / updateOneColumnControllers/Database/CentralColumnsController.php POST multi_edit_central_column_saveGET|POST /database/central-columnsGNU Affero GPL v3.0. See LICENSE. Loopback lab only. No warranty.