CVE-2004-2631

Vulnerability

An eval injection vulnerability exists in left.php of phpMyAdmin versions 2.5.1 through 2.5.7. The eval() function is used to process table names without proper sanitization. When the configuration option $cfg['LeftFrameLight'] is set to FALSE, an attacker can inject arbitrary PHP code by supplying a specially crafted table name [3][4].

Exploitation

Exploitation requires that $cfg['LeftFrameLight'] is FALSE. The attacker must be able to influence the table name that phpMyAdmin processes. This can be achieved by directing phpMyAdmin to a malicious MySQL server that returns a crafted table name, or by manipulating input variables that affect the table name [3]. The attacker does not need authentication if they can control the MySQL server connection [4].

Impact

Successful exploitation allows remote execution of arbitrary PHP code with the permissions of the web server. This can lead to full compromise of the server, including data disclosure, modification, or denial of service [3][4].

Mitigation

The vulnerability is fixed in phpMyAdmin version 2.5.7-pl1 and later [3]. As a workaround, set $cfg['LeftFrameLight'] to TRUE to disable the vulnerable code path. Additionally, ensuring PHP safe mode is enabled or restricting outbound network connections can limit the attack surface [3][4].