CVE-2016-5703 (published 2016-07-03T01:59Z)

SQL injection vulnerability in libraries/central_columns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/phpmyadmin/phpmyadmin
commit_details: repo_url: https://github.com/phpmyadmin/phpmyadmin
author: Michal Čihař
author_date: 2016-06-15 11:29:31+02:00
msg: Properly escape database name in central column queries

Signed-off-by: Michal Čihař <michal@cihar.com>
repository: repo_url: https://github.com/phpmyadmin/phpmyadmin
repo_name: phpmyadmin/phpmyadmin
description: A web interface for MySQL and MariaDB
repo_language: PHP
owner: phpmyadmin
file_changes: filename: central_columns.lib.php
change_type: ModificationType.MODIFY
diff: @@ -60,10 +60,10 @@ function PMA_getColumnsList($db, $from=0, $num=25)
     //get current values of $db from central column list
     if ($num == 0) {
         $query = 'SELECT * FROM ' . Util::backquote($central_list_table) . ' '
-            . 'WHERE db_name = \'' . $db . '\';';
+            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\';';
     } else {
         $query = 'SELECT * FROM ' . Util::backquote($central_list_table) . ' '
-            . 'WHERE db_name = \'' . $db . '\' '
+            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' '
             . 'LIMIT ' . $from . ', ' . $num . ';';
     }
     $has_list = (array) $GLOBALS['dbi']->fetchResult(
@@ -91,7 +91,7 @@ function PMA_getCentralColumnsCount($db)
     $central_list_table = $cfgCentralColumns['table'];
     $query = 'SELECT count(db_name) FROM ' .
         Util::backquote($central_list_table) . ' '
-        . 'WHERE db_name = \'' . $db . '\';';
+        . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\';';
     $res = $GLOBALS['dbi']->fetchResult(
         $query, null, null, $GLOBALS['controllink']
     );
@@ -122,7 +122,7 @@ function PMA_findExistingColNames($db, $cols, $allFields=false)
     $central_list_table = $cfgCentralColumns['table'];
     if ($allFields) {
         $query = 'SELECT * FROM ' . Util::backquote($central_list_table) . ' '
-            . 'WHERE db_name = \'' . $db . '\' AND col_name IN (' . $cols . ');';
+            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' AND col_name IN (' . $cols . ');';
         $has_list = (array) $GLOBALS['dbi']->fetchResult(
             $query, null, null, $GLOBALS['controllink']
         );
@@ -130,7 +130,7 @@ function PMA_findExistingColNames($db, $cols, $allFields=false)
     } else {
         $query = 'SELECT col_name FROM '
             . Util::backquote($central_list_table) . ' '
-            . 'WHERE db_name = \'' . $db . '\' AND col_name IN (' . $cols . ');';
+            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' AND col_name IN (' . $cols . ');';
         $has_list = (array) $GLOBALS['dbi']->fetchResult(
             $query, null, null, $GLOBALS['controllink']
         );
@@ -376,7 +376,7 @@ function PMA_deleteColumnsFromList($field_select, $isTable=true)
     $GLOBALS['dbi']->selectDb($pmadb, $GLOBALS['controllink']);
 
     $query = 'DELETE FROM ' . Util::backquote($central_list_table) . ' '
-        . 'WHERE db_name = \'' . $db . '\' AND col_name IN (' . $cols . ');';
+        . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' AND col_name IN (' . $cols . ');';
 
     if (!$GLOBALS['dbi']->tryQuery($query, $GLOBALS['controllink'])) {
         $message = Message::error(__('Could not remove columns!'));
@@ -1147,7 +1147,7 @@ function PMA_getCentralColumnsListRaw($db, $table)
     $centralTable = $cfgCentralColumns['table'];
     if (empty($table) || $table == '') {
         $query = 'SELECT * FROM ' . Util::backquote($centralTable) . ' '
-            . 'WHERE db_name = \'' . $db . '\';';
+            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\';';
     } else {
         $GLOBALS['dbi']->selectDb($db, $GLOBALS['userlink']);
         $columns = (array) $GLOBALS['dbi']->getColumnNames(
@@ -1159,7 +1159,7 @@ function PMA_getCentralColumnsListRaw($db, $table)
         }
         $cols = trim($cols, ',');
         $query = 'SELECT * FROM ' . Util::backquote($centralTable) . ' '
-            . 'WHERE db_name = \'' . $db . '\'';
+            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\'';
         if ($cols) {
             $query .= ' AND col_name NOT IN (' . $cols . ')';
         }

programming_language: PHP