CVE-2019-6799

MEDIUMNuclei

phpMyAdmin Arbitrary file read vulnerability

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2019-6799 has a selected CVSS score of 5.9 (medium); EIP currently links 1 Nuclei template.

Description

An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

phpmyadmin/phpmyadmin

Browse Packagist / phpmyadmin/phpmyadmin
GitHub Advisory4.8 to < 4.8.5 · Fixed in 4.8.5affected

Nuclei templates

1
ProjectDiscoveryMEDIUMphpMyAdmin <4.8.5 - Local File InclusionCVSS 5.9

phpMyAdmin before 4.8.5 is susceptible to local file inclusion. When the AllowArbitraryServer configuration setting is set to true, an attacker can read, with the use of a rogue MySQL server, any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of options(MYSQLI_OPT_LOCAL_INFIL calls.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files.

Remediation

Upgrade phpMyAdmin to version 4.8.5 or later to mitigate this vulnerability.

Authorspwnhxl
Template tagscvecve2019phpmyadminmysqllfrintrusivesqlivuln
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*
Shodan: title:"phpmyadmin"
Shodan: http.title:"phpmyadmin"
Shodan: http.component:"phpmyadmin"
Shodan: cpe:"cpe:2.3:a:phpmyadmin:phpmyadmin"
FOFA: body="pma_servername" && body="4.8.4"
FOFA: title="phpmyadmin"
Google: intitle:"phpmyadmin"
https://paper.seebug.org/1112/#_4 https://github.com/phpmyadmin/phpmyadmin/commit/828f740158e7bf14aa4a7473c5968d06364e03a2 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6799 https://github.com/rmb122/rogue_mysql_server https://github.com/vulnspy/phpmyadmin-4.8.4-allowarbitraryserver https://nvd.nist.gov/vuln/detail/CVE-2019-6799

Source: ProjectDiscovery

References

5