CVE-2019-12922 (published 2019-09-13T13:15Z)

A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:N/I:P/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/phpmyadmin/phpmyadmin
commit_details: repo_url: https://github.com/phpmyadmin/phpmyadmin
author: Maurício Meneghini Fauth
author_date: 2019-09-18 22:40:32-03:00
msg: Require POST method to delete servers in Setup

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
repository: repo_url: https://github.com/phpmyadmin/phpmyadmin
repo_name: phpmyadmin/phpmyadmin
description: A web interface for MySQL and MariaDB
repo_language: PHP
owner: phpmyadmin
file_changes: filename: index.inc.php
change_type: ModificationType.MODIFY
diff: @@ -156,8 +156,9 @@
         echo '<a href="' , Url::getCommon(array('page' => 'servers', 'mode' => 'edit', 'id' => $id)), '">'
             , __('Edit') , '</a>';
         echo ' | ';
-        echo '<a href="' , Url::getCommon(array('page' => 'servers', 'mode' => 'remove', 'id' => $id)), '">'
-            , __('Delete') , '</a>';
+        echo '<a class="delete-server" href="' . Url::getCommon(array('page' => 'servers', 'mode' => 'remove', 'id' => $id));
+        echo '" data-post="' . Url::getCommon(array('token' => $_SESSION[' PMA_token ']), '') . '">';
+        echo __('Delete') . '</a>';
         echo '</small>';
         echo '</td>';
         echo '</tr>';

programming_language: PHP
filename: servers.inc.php
change_type: ModificationType.MODIFY
diff: @@ -27,7 +27,7 @@
     $page_title = __('Edit server')
         . ' ' . $id
         . ' <small>(' . htmlspecialchars($cf->getServerDSN($id)) . ')</small>';
-} elseif ($mode == 'remove' && $server_exists) {
+} elseif ($mode == 'remove' && $server_exists && $_SERVER['REQUEST_METHOD'] == 'POST') {
     $cf->removeServer($id);
     header('Location: index.php' . Url::getCommonRaw());
     exit;

programming_language: PHP
filename: scripts.js
change_type: ModificationType.MODIFY
diff: @@ -216,3 +216,13 @@ $(function () {
 //
 // END: User preferences allow/disallow UI
 // ------------------------------------------------------------------
+
+$(function () {
+    $('.delete-server').on('click', function (e) {
+        e.preventDefault();
+        var $this = $(this);
+        $.post($this.attr('href'), $this.attr('data-post'), function () {
+            window.location.replace('index.php');
+        });
+    });
+});

programming_language: JavaScript
repo_url: https://github.com/phpmyadmin/phpmyadmin
commit_details: repo_url: https://github.com/phpmyadmin/phpmyadmin
author: Isaac Bennetch
author_date: 2019-09-20 18:02:38-04:00
msg: Add ChangeLog entries for:

* 427fbed55d3154d96ecfc1c7784d49eaa3c04161
* 6e1bbc54c266c210e47e40946f4a6f314c8a36a7

Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
repository: repo_url: https://github.com/phpmyadmin/phpmyadmin
repo_name: phpmyadmin/phpmyadmin
description: A web interface for MySQL and MariaDB
repo_language: PHP
owner: phpmyadmin
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,8 @@ phpMyAdmin - ChangeLog
 - issue #15440 Fix page number is not being updated in the URL after saving a designer's page
 - issue        Fix reloading a designer's page
 - issue        Fix designer full screen mode button and text stuck when exiting full-screen mode
+- issue        Reduced possibility of causing heavy server traffic between the database and web servers
+- issue        Fix a situation where a server could be deleted while an administator is using the setup script
 
 4.9.0.1 (2019-06-04)
 - issue #14478 phpMyAdmin no longer streams the export data

programming_language: SQL