CVE-2013-3238: Insufficient Information (NVD-CWE-noinfo)
value: phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2013-04-26T03:34Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/mult_submits.inc.php
Commit date: 2013-04-24 07:56:27 -0400
Commit message: Dropped unsafe usage of preg_replace

It could be tricked by apending /e\x00 to execute arbitrary php code.
The new code does simple string replace, we don't really need any of
regex stuff here.

Diff: diff --git a/libraries/mult_submits.inc.php b/libraries/mult_submits.inc.php
index 30654922eb3..1eafb96c3dc 100644
--- a/libraries/mult_submits.inc.php
+++ b/libraries/mult_submits.inc.php
@@ -423,18 +423,27 @@
                 $run_parts = true;
                 break;
 
             case 'replace_prefix_tbl':
                 $current = $selected[$i];
-                $newtablename = preg_replace("/^" . $from_prefix . "/", $to_prefix, $current);
+                if (substr($current, 0, strlen($from_prefix)) == $from_prefix) {
+                    $newtablename = $to_prefix . substr($current, strlen($from_prefix));
+                } else {
+                    $newtablename = $current;
+                }
                 $a_query = 'ALTER TABLE ' . PMA_backquote($selected[$i]) . ' RENAME ' . PMA_backquote($newtablename) ; // CHANGE PREFIX PATTERN
                 $run_parts = true;
                 break;
 
             case 'copy_tbl_change_prefix':
                 $current = $selected[$i];
-                $newtablename = preg_replace("/^" . $from_prefix . "/", $to_prefix, $current);
+                if (substr($current, 0, strlen($from_prefix)) == $from_prefix) {
+                    $newtablename = $to_prefix . substr($current, strlen($from_prefix));
+                } else {
+                    $newtablename = $current;
+                }
+                $newtablename = $to_prefix . substr($current, strlen($from_prefix));
                 $a_query = 'CREATE TABLE ' . PMA_backquote($newtablename) . ' SELECT * FROM ' . PMA_backquote($selected[$i]) ; // COPY TABLE AND CHANGE PREFIX PATTERN
                 $run_parts = true;
                 break;
 
         } // end switch

Vulnerable code:                 $newtablename = preg_replace("/^" . $from_prefix . "/", $to_prefix, $current);
                $newtablename = preg_replace("/^" . $from_prefix . "/", $to_prefix, $current);
Fixed code:                 if (substr($current, 0, strlen($from_prefix)) == $from_prefix) {
                    $newtablename = $to_prefix . substr($current, strlen($from_prefix));
                } else {
                    $newtablename = $current;
                }
                if (substr($current, 0, strlen($from_prefix)) == $from_prefix) {
                    $newtablename = $to_prefix . substr($current, strlen($from_prefix));
                } else {
                    $newtablename = $current;
                }
                $newtablename = $to_prefix . substr($current, strlen($from_prefix));