CVE-2016-5730 (PHP, published 2016-07-03T01:59Z)
Description: value: phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/config/Validator.php
Commit message: Validate input of validator

We can not trust the input here, so we can expect anything and deal with
missing parameters or invalid values.

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
            $password = $values['Servers/1/nopassword'] ? null
                : $values['Servers/1/password'];
                $values['Servers/1/connect_type'],
                $values['Servers/1/host'],
                $values['Servers/1/port'],
                $values['Servers/1/socket'],
                $values['Servers/1/user'],
        if ($values['Servers/1/pmadb'] == '') {
        if ($values['Servers/1/controluser'] == '') {
        if ($values['Servers/1/controlpass'] == '') {
                $values['Servers/1/connect_type'],
                $values['Servers/1/host'], $values['Servers/1/port'],
                $values['Servers/1/socket'], $values['Servers/1/controluser'],
                $values['Servers/1/controlpass'], 'Server_pmadb'
        if ($values[$path] == '') {
        preg_match('/' . $values[$path] . '/', '', $matches);
        if (is_array($values[$path])) {
        if ($values[$path] === '') {
        if (intval($values[$path]) != $values[$path]
            || (! $allow_neg && $values[$path] < 0)
            || (! $allow_zero && $values[$path] == 0)
            || $values[$path] > $max_value
        $result = preg_match($regex, $values[$path]);

Fixed code:
use PMA\libraries\Util;
        if (empty($values['Servers/1/auth_type'])) {
            $values['Servers/1/auth_type'] = '';
            $result['Servers/1/auth_type'] = __('Invalid authentication type!');
            $error = true;
        }
            $password = !empty($values['Servers/1/nopassword']) && $values['Servers/1/nopassword'] ? null
                : (empty($values['Servers/1/password']) ? '' : $values['Servers/1/password']);
                empty($values['Servers/1/connect_type']) ? '' : $values['Servers/1/connect_type'],
                empty($values['Servers/1/host']) ? '' : $values['Servers/1/host'],
                empty($values['Servers/1/port']) ? '' : $values['Servers/1/port'],
                empty($values['Servers/1/socket']) ? '' : $values['Servers/1/socket'],
                empty($values['Servers/1/user']) ? '' : $values['Servers/1/user'],
        if (empty($values['Servers/1/pmadb'])) {
        if (empty($values['Servers/1/controluser'])) {
        if (empty($values['Servers/1/controlpass'])) {
                empty($values['Servers/1/connect_type']) ? '' : $values['Servers/1/connect_type'],
                empty($values['Servers/1/host']) ? '' : $values['Servers/1/host'],
                empty($values['Servers/1/port']) ? '' : $values['Servers/1/port'],
                empty($values['Servers/1/socket']) ? '' : $values['Servers/1/socket'],
                empty($values['Servers/1/controluser']) ? '' : $values['Servers/1/controluser'],
                empty($values['Servers/1/controlpass']) ? '' : $values['Servers/1/controlpass'],
                'Server_pmadb'
        if (empty($values[$path])) {
        preg_match('/' . Util::requestString($values[$path]) . '/', '', $matches);
        if (is_array($values[$path]) || is_object($values[$path])) {
                $v = Util::requestString($v);
        if (empty($values[$path])) {
        $value = Util::requestString($values[$path]);

        if (intval($value) != $value
            || (! $allow_neg && $value < 0)
            || (! $allow_zero && $value == 0)
            || $value > $max_value
        if (!isset($values[$path])) {
            return '';
        }
        $result = preg_match($regex, Util::requestString($values[$path]));