CVE-2013-5003

Vulnerability

Multiple SQL injection vulnerabilities exist in phpMyAdmin versions 3.5.x prior to 3.5.8.2 and 4.0.x prior to 4.0.4.2. The flaws reside in the pmd_pdf.php and schema_export.php scripts, where the scale and pdf_page_number parameters, respectively, are not properly validated before being used in SQL queries. This allows an authenticated user to inject arbitrary SQL statements. The vulnerability is triggered only when a control user has been configured as part of the phpMyAdmin configuration storage installation [2].

Exploitation

An attacker must be logged into phpMyAdmin to exploit these vulnerabilities, as the standard token protection prevents unauthenticated access to the required forms. Additionally, a control user must have been created and configured in the phpMyAdmin configuration storage. The attacker can then craft a malicious request to pmd_pdf.php or schema_export.php with a specially crafted scale or pdf_page_number parameter containing SQL injection payloads [2].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands with the privileges of the control user. This grants read and write access to the tables of the configuration storage database. If the control user has sufficient privileges, the attacker may also gain read access to some tables of the mysql database, leading to privilege escalation beyond the attacker's original permissions [2].

Mitigation

The vulnerabilities are fixed in phpMyAdmin versions 3.5.8.2 and 4.0.4.2, released on 2013-07-28. Users should upgrade to these versions or apply the provided patches. No workarounds are documented. The issue is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [2].