Path traversal in phpmyadmin (Alpine package)

1) Path traversal

EUVDB-ID: #VU33613

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-6614

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

Mitigation

Install update from vendor's website.

Vulnerable software versions

phpmyadmin (Alpine package): 4.0.4.1-r0 - 4.4.15.7-r0

CPE2.3

• cpe:2.3:a:alpine:phpmyadmin_alpine_package:4.0.4.1-r0:*:*:*:*:alpine_linux:*:2.6
• cpe:2.3:a:alpine:phpmyadmin_alpine_package:4.0.4.2-r0:*:*:*:*:alpine_linux:*:2.6
• cpe:2.3:a:alpine:phpmyadmin_alpine_package:4.0.9-r0:*:*:*:*:alpine_linux:*:2.6

External links

https://git.alpinelinux.org/aports/commit/?id=abae6704b5ad5fa0ac123378e37f2b81d2585ff0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.