CVE-2013-3238 (published 2013-04-26T03:34Z)

phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature.

Severity: MEDIUM
CVSS v2 base score: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/phpmyadmin/phpmyadmin
commit_details: repo_url: https://github.com/phpmyadmin/phpmyadmin
author: Michal Čihař
author_date: 2013-04-16 15:15:05+02:00
msg: Dropped unsafe usage of preg_replace

It could be tricked by apending /e\x00 to execute arbitrary php code.
The new code does simple string replace, we don't really need any of
regex stuff here.
repository: repo_url: https://github.com/phpmyadmin/phpmyadmin
repo_name: phpmyadmin/phpmyadmin
description: A web interface for MySQL and MariaDB
repo_language: PHP
owner: phpmyadmin
file_changes: filename: mult_submits.inc.php
change_type: ModificationType.MODIFY
diff: @@ -425,14 +425,23 @@
 
             case 'replace_prefix_tbl':
                 $current = $selected[$i];
-                $newtablename = preg_replace("/^" . $from_prefix . "/", $to_prefix, $current);
+                if (substr($current, 0, strlen($from_prefix)) == $from_prefix) {
+                    $newtablename = $to_prefix . substr($current, strlen($from_prefix));
+                } else {
+                    $newtablename = $current;
+                }
                 $a_query = 'ALTER TABLE ' . PMA_backquote($selected[$i]) . ' RENAME ' . PMA_backquote($newtablename) ; // CHANGE PREFIX PATTERN
                 $run_parts = true;
                 break;
 
             case 'copy_tbl_change_prefix':
                 $current = $selected[$i];
-                $newtablename = preg_replace("/^" . $from_prefix . "/", $to_prefix, $current);
+                if (substr($current, 0, strlen($from_prefix)) == $from_prefix) {
+                    $newtablename = $to_prefix . substr($current, strlen($from_prefix));
+                } else {
+                    $newtablename = $current;
+                }
+                $newtablename = $to_prefix . substr($current, strlen($from_prefix));
                 $a_query = 'CREATE TABLE ' . PMA_backquote($newtablename) . ' SELECT * FROM ' . PMA_backquote($selected[$i]) ; // COPY TABLE AND CHANGE PREFIX PATTERN
                 $run_parts = true;
                 break;

programming_language: PHP
repo_url: https://github.com/phpmyadmin/phpmyadmin
commit_details: repo_url: https://github.com/phpmyadmin/phpmyadmin
author: Marc Delisle
author_date: 2013-04-18 05:53:58-04:00
msg: Prevent null-byte injection in preg_replace()
repository: repo_url: https://github.com/phpmyadmin/phpmyadmin
repo_name: phpmyadmin/phpmyadmin
description: A web interface for MySQL and MariaDB
repo_language: PHP
owner: phpmyadmin
file_changes: filename: Tracker.class.php
change_type: ModificationType.MODIFY
diff: @@ -877,6 +877,9 @@ static public function handleQuery($query)
         if (empty($dbname)) {
             return;
         }
+        // Remove null bytes (preg_replace() is vulnerable in some
+        // PHP versions)
+        $dbname = str_replace("\0", "", $dbname);
 
         // If we found a valid statement
         if (isset($result['identifier'])) {

programming_language: PHP