CVE-2004-2632

Vulnerability

In phpMyAdmin versions 2.5.1 through 2.5.7, a remote attacker can modify configuration settings by appending new $cfg['Servers'] variables via GET parameters. Additionally, when $cfg['LeftFrameLight'] is set to FALSE, an attacker can supply a specially formatted table name that is passed to an eval() function, leading to arbitrary PHP code execution. This second vector requires the attacker to use a modified MySQL server that returns crafted table names [1][2].

Exploitation

For the configuration modification vector, an authenticated attacker simply appends ?cfg[Servers][...]=... to the URL. For the code execution vector, the attacker must have the $cfg['LeftFrameLight'] option disabled and must be able to make phpMyAdmin contact a malicious MySQL server that returns a crafted table name. The attacker does not need special privileges beyond a valid phpMyAdmin account. The sequence involves setting up a rogue MySQL server that, when queried by phpMyAdmin, returns a table name containing PHP code, which phpMyAdmin then evaluates with eval(). Both vectors can be combined to achieve remote code execution [1][2].

Impact

An attacker who successfully exploits either vector can read, modify, or delete configuration settings, potentially gaining unauthorized access to MySQL servers. In the worst case, using the table-name eval vector, the attacker can execute arbitrary PHP code on the web server with the permissions of the web server process. This can lead to full compromise of the web application and its underlying database, as well as potential denial of service or further lateral movement within the network [1][2].

Mitigation

phpMyAdmin 2.5.7-pl1 (released shortly after disclosure) fixes both vulnerabilities. Users should upgrade to this version or later. As a workaround, set $cfg['LeftFrameLight'] to TRUE in the configuration file, which disables the vulnerable eval() code path. The default Gentoo installation has this set to TRUE, limiting exposure to the second vector. No workaround exists for the configuration modification vector aside from upgrading [1][2].