CVE-2013-3238

Vulnerability

phpMyAdmin versions 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 are vulnerable to remote code execution in the "Replace table prefix" feature. The application passes user-supplied input to preg_replace() without proper sanitization. By injecting a null byte (\x00) followed by an /e modifier, an attacker can leverage PHP's preg_replace code execution behavior (when the /e modifier is present) to execute arbitrary PHP code [3]. The affected versions are explicitly listed in [3].

Exploitation

An attacker must be authenticated to phpMyAdmin. The vulnerability is triggered by crafting a malicious prefix replacement pattern containing a /e\x00 sequence. The /e modifier causes preg_replace to evaluate the replacement string as PHP code, and the null byte prevents proper validation. The exploit can be performed via the "Replace table prefix" form under the "Operations" tab [1][3]. A Metasploit module is available [1].

Impact

Successful exploitation allows a remote authenticated attacker to execute arbitrary PHP code on the web server with the privileges of the web server user. This can lead to full compromise of the phpMyAdmin installation and potentially the underlying database [3].

Mitigation

Upgrade to phpMyAdmin 3.5.8 or newer (for 3.5.x) or 4.0.0-rc3 or newer (for 4.x) [3]. The fix involves proper null-byte filtering before passing input to preg_replace() as seen in commit [2]. Distribution-specific updates are available, e.g., Mageia advisory MGASA-2013-0133 [4]. No known workaround exists for unpatched versions; the feature should be disabled if upgrade is not possible.