SB2017032808 - Security restrictions bypass in phpMyAdmin
Published: March 28, 2017 Updated: November 23, 2019
Security Bulletin ID
SB2017032808
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Protection Mechanism Failure (CVE-ID: CVE-2017-18264)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to unexpected behavior of the subst() PHP function that returns false when given '' as the first argument in PHP 5.x. A remote attacker can bypass configured "$cfg['Servers'][$i]['AllowNoPassword'] = false" setting and login under account that has not password set.
Remediation
Install update from vendor's website.