Vulnerability: Improper Authentication in phpmyadmin An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.
Vulnerability ID: GHSA-8wf2-3ggj-78q9
CWE: CWE-287
Severity score: 4.3
Project: https://github.com/phpmyadmin/phpmyadmin
Published: 2022-01-28
File: libraries/classes/DatabaseInterface.php
Commit message: security - Fix - 2FA/U2F can be disabled without any code change

Signed-off-by: William Desportes <williamdes@wdes.fr>
Commit author: William Desportes

Vulnerable version (before fix):
 public function setCollation($collation)      */     public function initRelationParamsCache()     {         if (strlen($GLOBALS['db'])) {             $cfgRelation = $this->relation->getRelationsParam();             if (empty($cfgRelation['db'])) {                 $this->relation->fixPmaTables($GLOBALS['db'], false);             }         }         $cfgRelation = $this->relation->getRelationsParam();         if (empty($cfgRelation['db']) && isset($GLOBALS['dblist'])) {             if ($GLOBALS['dblist']->databases->exists('phpmyadmin')) {                 $this->relation->fixPmaTables('phpmyadmin', false);             }         }     } 

Fixed version (after fix):
 public function setCollation($collation)      */     public function initRelationParamsCache()     {         $storageDbName = $GLOBALS['cfg']['Server']['pmadb'] ?? '';         // Use "phpmyadmin" as a default database name to check to keep the behavior consistent         $storageDbName = $storageDbName !== null                             && is_string($storageDbName)                             && $storageDbName !== '' ? $storageDbName : 'phpmyadmin';          // This will make users not having explicitly listed databases         // have config values filled by the default phpMyAdmin storage table name values         $this->relation->fixPmaTables($storageDbName, false);          // This global will be changed if fixPmaTables did find one valid table         $storageDbName = $GLOBALS['cfg']['Server']['pmadb'] ?? '';          // Empty means that until now no pmadb was found eligible         if (empty($storageDbName)) {             $this->relation->fixPmaTables($GLOBALS['db'], false);         }     } 

Patch:
patch: @@ -1563,17 +1563,22 @@ public function setCollation($collation)
      */
     public function initRelationParamsCache()
     {
-        if (strlen($GLOBALS['db'])) {
-            $cfgRelation = $this->relation->getRelationsParam();
-            if (empty($cfgRelation['db'])) {
-                $this->relation->fixPmaTables($GLOBALS['db'], false);
-            }
-        }
-        $cfgRelation = $this->relation->getRelationsParam();
-        if (empty($cfgRelation['db']) && isset($GLOBALS['dblist'])) {
-            if ($GLOBALS['dblist']->databases->exists('phpmyadmin')) {
-                $this->relation->fixPmaTables('phpmyadmin', false);
-            }
+        $storageDbName = $GLOBALS['cfg']['Server']['pmadb'] ?? '';
+        // Use "phpmyadmin" as a default database name to check to keep the behavior consistent
+        $storageDbName = $storageDbName !== null
+                            && is_string($storageDbName)
+                            && $storageDbName !== '' ? $storageDbName : 'phpmyadmin';
+
+        // This will make users not having explicitly listed databases
+        // have config values filled by the default phpMyAdmin storage table name values
+        $this->relation->fixPmaTables($storageDbName, false);
+
+        // This global will be changed if fixPmaTables did find one valid table
+        $storageDbName = $GLOBALS['cfg']['Server']['pmadb'] ?? '';
+
+        // Empty means that until now no pmadb was found eligible
+        if (empty($storageDbName)) {
+            $this->relation->fixPmaTables($GLOBALS['db'], false);
         }
     }
path: libraries/classes/DatabaseInterface.php