CVE-2016-5730: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/config/FormDisplay.php
Commit date: 2016-06-17 09:12:28 +0200
Commit message: Properly convert POST parameters

We can get array instead of single parameter, so handle this gracefully.

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/libraries/config/FormDisplay.php b/libraries/config/FormDisplay.php
index ab02fa1f70b90..aeff097624d68 100644
--- a/libraries/config/FormDisplay.php
+++ b/libraries/config/FormDisplay.php
@@ -637,16 +637,16 @@ public function save($forms, $allow_partial_save = true)
                 }
 
                 // cast variables to correct type
                 switch ($type) {
                 case 'double':
-                    settype($_POST[$key], 'float');
+                    settype($this->_trimString($_POST[$key]), 'float');
                     break;
                 case 'boolean':
                 case 'integer':
                     if ($_POST[$key] !== '') {
-                        settype($_POST[$key], $type);
+                        settype($this->_trimString($_POST[$key]), $type);
                     }
                     break;
                 case 'select':
                     $successfully_validated = $this->_validateSelect(
                         $_POST[$key],
@@ -658,11 +658,11 @@ public function save($forms, $allow_partial_save = true)
                         continue;
                     }
                     break;
                 case 'string':
                 case 'short_string':
-                    $_POST[$key] = trim($_POST[$key]);
+                    $_POST[$key] = $this->_trimString($_POST[$key]);
                     break;
                 case 'array':
                     // eliminate empty values and ensure we have an array
                     $post_values = is_array($_POST[$key])
                         ? $_POST[$key]
@@ -874,12 +874,27 @@ private function _setComments($system_path, array &$opts)
      * @return void
      */
     private function _fillPostArrayParameters($post_values, $key)
     {
         foreach ($post_values as $v) {
-            $v = trim($v);
+            $v = $this->_trimString($v);
             if ($v !== '') {
                 $_POST[$key][] = $v;
             }
         }
     }
+
+    /*
+     * Converts given (request) paramter to string
+     *
+     * @param mixed $value Value to convert
+     *
+     * @return string
+     */
+    private function _trimString($value)
+    {
+        while (is_array($value)) {
+            $value = reset($value);
+        }
+        return trim((string)$value);
+    }
 }

Vulnerable code:                     settype($_POST[$key], 'float');
                        settype($_POST[$key], $type);
                    $_POST[$key] = trim($_POST[$key]);
            $v = trim($v);
Fixed code:                     settype($this->_trimString($_POST[$key]), 'float');
                        settype($this->_trimString($_POST[$key]), $type);
                    $_POST[$key] = $this->_trimString($_POST[$key]);
            $v = $this->_trimString($v);

    /*
     * Converts given (request) paramter to string
     *
     * @param mixed $value Value to convert
     *
     * @return string
     */
    private function _trimString($value)
    {
        while (is_array($value)) {
            $value = reset($value);
        }
        return trim((string)$value);
    }