CVE-2016-2038: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2016-02-20T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: setup/frames/form.inc.php, setup/index.php, setup/validate.php
Commit date: 2016-01-19 10:22:30 +1100
Commit message: Fix path disclosure, items 1.4.x, 1.5 and 1.6

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>

Diff: diff --git a/setup/frames/form.inc.php b/setup/frames/form.inc.php
index e3cdf98f535ac..0efb6429fb15b 100644
--- a/setup/frames/form.inc.php
+++ b/setup/frames/form.inc.php
@@ -17,13 +17,13 @@
 require_once './libraries/config/FormDisplay.class.php';
 require_once './setup/lib/form_processing.lib.php';
 
 require './libraries/config/setup.forms.php';
 
-$formset_id = isset($_GET['formset']) ? $_GET['formset'] : null;
+$formset_id = PMA_isValid($_GET['formset'], 'scalar') ? $_GET['formset'] : null;
 $mode = isset($_GET['mode']) ? $_GET['mode'] : null;
-if (! isset($forms[$formset_id])) {
+if (! isset($forms[$formset_id]) || substr($formset_id, 0, 1) === '_') {
     PMA_fatalError(__('Incorrect formset, check $formsets array in setup/frames/form.inc.php!'));
 }
 
 if (isset($GLOBALS['strConfigFormset_' . $formset_id])) {
     echo '<h2>' . $GLOBALS['strConfigFormset_' . $formset_id] . '</h2>';
diff --git a/setup/index.php b/setup/index.php
index 2f8f8a7b0eb26..0cc8edac684be 100644
--- a/setup/index.php
+++ b/setup/index.php
@@ -10,22 +10,22 @@
 /**
  * Core libraries.
  */
 require './lib/common.inc.php';
 
-$page = isset($_GET['page']) ? $_GET['page'] : null;
+$page = PMA_isValid($_GET['page'], 'scalar') ? $_GET['page'] : null;
 $page = preg_replace('/[^a-z]/', '', $page);
 if ($page === '') {
     $page = 'index';
 }
 if (!file_exists("./setup/frames/$page.inc.php")) {
     // it will happen only when entering URL by hand, we don't care for these cases
     PMA_fatalError(__('Wrong GET file attribute value'));
 }
 
 // Handle done action info
-$action_done = isset($_GET['action_done']) ? $_GET['action_done'] : null;
+$action_done = PMA_isValid($_GET['action_done'], 'scalar') ? $_GET['action_done'] : null;
 $action_done = preg_replace('/[^a-z_]/', '', $action_done);
 
 PMA_noCacheHeader();
 
 ?>
diff --git a/setup/validate.php b/setup/validate.php
index 5759042aa5a9a..6aa402e01533e 100644
--- a/setup/validate.php
+++ b/setup/validate.php
@@ -14,13 +14,13 @@
 $validators = array();
 require './libraries/config/Validator.class.php';
 
 header('Content-type: application/json');
 
-$ids = isset($_POST['id']) ? $_POST['id'] : null;
+$ids = PMA_isValid($_POST['id'], 'scalar') ? $_POST['id'] : null;
 $vids = explode(',', $ids);
-$vals = isset($_POST['values']) ? $_POST['values'] : null;
+$vals = PMA_isValid($_POST['values'], 'scalar') ? $_POST['values'] : null;
 $values = json_decode($vals);
 if (!($values instanceof stdClass)) {
     PMA_fatalError(__('Wrong data'));
 }
 $values = (array)$values;

Vulnerable code: $formset_id = isset($_GET['formset']) ? $_GET['formset'] : null;
if (! isset($forms[$formset_id])) {
$page = isset($_GET['page']) ? $_GET['page'] : null;
$action_done = isset($_GET['action_done']) ? $_GET['action_done'] : null;
$ids = isset($_POST['id']) ? $_POST['id'] : null;
$vals = isset($_POST['values']) ? $_POST['values'] : null;
Fixed code: $formset_id = PMA_isValid($_GET['formset'], 'scalar') ? $_GET['formset'] : null;
if (! isset($forms[$formset_id]) || substr($formset_id, 0, 1) === '_') {
$page = PMA_isValid($_GET['page'], 'scalar') ? $_GET['page'] : null;
$action_done = PMA_isValid($_GET['action_done'], 'scalar') ? $_GET['action_done'] : null;
$ids = PMA_isValid($_POST['id'], 'scalar') ? $_POST['id'] : null;
$vals = PMA_isValid($_POST['values'], 'scalar') ? $_POST['values'] : null;