CVE-2016-5734: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: import.php, libraries/Tracker.php, libraries/plugins/export/ExportSql.php, templates/columns_definitions/transformation.phtml, test/libraries/core/PMA_warnMissingExtension_test.php
Commit date: 2016-06-20 12:16:03 +0200
Commit message: Quote delimiter before using preg_replace

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/import.php b/import.php
index 7315a8f7fc4e0..ae0eaef802bad 100644
--- a/import.php
+++ b/import.php
@@ -109,11 +109,11 @@
     if (! empty($_REQUEST['parameterized'])
         && ! empty($_REQUEST['parameters'])
         && is_array($_REQUEST['parameters'])) {
         $parameters = $_REQUEST['parameters'];
         foreach ($parameters as $parameter => $replacement) {
-            $quoted = preg_quote($parameter);
+            $quoted = preg_quote($parameter, '/');
             // making sure that :param does not apply values to :param1
             $sql_query = preg_replace(
                 '/' . $quoted . '([^a-zA-Z0-9_])/',
                 PMA\libraries\Util::sqlAddSlashes($replacement) . '${1}',
                 $sql_query
diff --git a/libraries/Tracker.php b/libraries/Tracker.php
index 8f7e3d43dcaeb..a4cb56c99f517 100644
--- a/libraries/Tracker.php
+++ b/libraries/Tracker.php
@@ -901,11 +901,11 @@ static public function handleQuery($query)
                 }
                 $date  = date('Y-m-d H:i:s');
 
                 // Cut off `dbname`. from query
                 $query = preg_replace(
-                    '/`' . preg_quote($dbname) . '`\s?\./',
+                    '/`' . preg_quote($dbname, '/') . '`\s?\./',
                     '',
                     $query
                 );
 
                 // Add log information
diff --git a/libraries/plugins/export/ExportSql.php b/libraries/plugins/export/ExportSql.php
index 8b531076b78c7..7812c7c732112 100644
--- a/libraries/plugins/export/ExportSql.php
+++ b/libraries/plugins/export/ExportSql.php
@@ -1504,11 +1504,11 @@ public function getTableDef(
              * database name, but we don't want name to show up in CREATE VIEW
              * statement.
              */
             if ($view) {
                 $create_query = preg_replace(
-                    '/' . preg_quote(Util::backquote($db)) . '\./',
+                    '/' . preg_quote(Util::backquote($db), '/') . '\./',
                     '',
                     $create_query
                 );
             }
 
diff --git a/templates/columns_definitions/transformation.phtml b/templates/columns_definitions/transformation.phtml
index d12e996bcad5c..96467007ada42 100644
--- a/templates/columns_definitions/transformation.phtml
+++ b/templates/columns_definitions/transformation.phtml
@@ -5,11 +5,11 @@
     <?php if (isset($available_mime[$type]) && is_array($available_mime[$type])): ?>
         <?php foreach ($available_mime[$type] as $mimekey => $transform): ?>
             <?php
                 $checked = isset($columnMeta['Field'])
                          && isset($mime_map[$columnMeta['Field']][$type])
-                         && preg_match('@' . preg_quote($available_mime[$type . '_file'][$mimekey]) . '3?@i',
+                         && preg_match('@' . preg_quote($available_mime[$type . '_file'][$mimekey], '@') . '3?@i',
                                         $mime_map[$columnMeta['Field']][$type]) ? 'selected ' : '';
                 $tooltip = PMA_getTransformationDescription(
                     $available_mime[$type . '_file'][$mimekey]
                 );
                 $parts = explode(":", $transform);
@@ -22,6 +22,6 @@
                     title="<?= htmlspecialchars($tooltip); ?>">
                 <?= htmlspecialchars($name); ?>
             </option>
         <?php endforeach; ?>
     <?php endif; ?>
-</select>
\ No newline at end of file
+</select>
diff --git a/test/libraries/core/PMA_warnMissingExtension_test.php b/test/libraries/core/PMA_warnMissingExtension_test.php
index 7f74e285c1ea6..1c6a2129a3494 100644
--- a/test/libraries/core/PMA_warnMissingExtension_test.php
+++ b/test/libraries/core/PMA_warnMissingExtension_test.php
@@ -57,11 +57,11 @@ function testMissingExtensionFatal()
         $ext = 'php_ext';
         $warn = 'The <a href="' . PMA_getPHPDocLink('book.' . $ext . '.php')
             . '" target="Documentation"><em>' . $ext
             . '</em></a> extension is missing. Please check your PHP configuration.';
 
-        $this->expectOutputRegex('@' . preg_quote($warn) . '@');
+        $this->expectOutputRegex('@' . preg_quote($warn, '@') . '@');
 
         PMA_warnMissingExtension($ext, true);
     }
 
     /**

Vulnerable code:             $quoted = preg_quote($parameter);
                    '/`' . preg_quote($dbname) . '`\s?\./',
                    '/' . preg_quote(Util::backquote($db)) . '\./',
                         && preg_match('@' . preg_quote($available_mime[$type . '_file'][$mimekey]) . '3?@i',
</select>
        $this->expectOutputRegex('@' . preg_quote($warn) . '@');
Fixed code:             $quoted = preg_quote($parameter, '/');
                    '/`' . preg_quote($dbname, '/') . '`\s?\./',
                    '/' . preg_quote(Util::backquote($db), '/') . '\./',
                         && preg_match('@' . preg_quote($available_mime[$type . '_file'][$mimekey], '@') . '3?@i',
</select>
        $this->expectOutputRegex('@' . preg_quote($warn, '@') . '@');