Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PhpMyAdmin Project Successfully Completes Security Audit

phpmyadmin.net

Post reply on HN
Print view View original

1–10 of 112 posts

Re: PhpMyAdmin Project Successfully Completes Security Audit

#3

Post by sync »

> A lack of filtering on user CSV output that could allow an attacker to run arbitrary code on an administrator's computer.

> Improper cookie invalidation that could allow an attacker to unset internal global variables.

Those don't count as serious issues? Props to them for making the report public though.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#5

Post by igravious »

Secure Open Source has completed[1] the following audits.

    - PCRE v2 audited by Cure53[2]
      1 Critical
      5 Medium
      20 Low
      3 Informational

    - libjpeg-turbo audited by Cure53
      1 High
      2 Medium
      2 Low

    - phpMyAdmin audited by NCC Group[3]
      3 Medium
      5 Low
      1 Informational
[1] https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed

[2] https://cure53.de/

[3] https://www.nccgroup.trust/uk/

Re: PhpMyAdmin Project Successfully Completes Security Audit

#7

Post by creshal »

sync wrote: post #3

> A lack of filtering on user CSV output that could allow an attacker to run arbitrary code on an administrator's computer. > Improper cookie invalidation that could allow an attacker to unset internal global variables. Those don't count as serious issues? Props to them for making the report public though.

> > A lack of filtering on user CSV output that could allow an attacker to run arbitrary code on an administrator's computer.

Iff the user has Excel, and explicitly allows it to run macros in a CSV file. It's already a stretch to call this a phpMyAdmin vulnerability, much less a "medium severity" one.

> > Improper cookie invalidation that could allow an attacker to unset internal global variables.

From the PDF report:

> Note: Because of the large amount of global variables, and the relatively short nature of this assessment, NCC Group was unable to fully determine the impact of this vulnerability.

It might be serious, but they didn't have enough budget to make a proper analysis.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#8

Post by creshal »

smaili wrote: post #2

Does anyone still use this? I didn't realize this was still actively maintained.

If you are using MySQL, and need to manually fuck around with tables for whatever reason, it's really useful and beats most other options.

For us it sees plenty of use with poorly developed legacy software (e.g. Wordpress).

Re: PhpMyAdmin Project Successfully Completes Security Audit

#9

Post by sciurus »

sync wrote: post #3

> A lack of filtering on user CSV output that could allow an attacker to run arbitrary code on an administrator's computer. > Improper cookie invalidation that could allow an attacker to unset internal global variables. Those don't count as serious issues? Props to them for making the report public though.

Interestingly, Google specifically excludes CSV vulnerabilities like that from their bug bounty program.

> CSV files are just text files (the format is defined in RFC 4180) and evaluating formulas is a behavior of only a subset of the applications opening them - it's rather a side effect of the CSV format and not a vulnerability in our products which can export user-created CSVs. This issue should mitigated by the application which would be importing/interpreting data from an external source, as Microsoft Excel does (for example) by showing a warning. In other words, the proper fix should be applied when opening the CSV files, rather then when creating them.

https://sites.google.com/site/bughunteruniversity/nonvuln/cs...

Re: PhpMyAdmin Project Successfully Completes Security Audit

#10

Post by martinczerwi »

creshal wrote: post #8
smaili wrote: post #2

Does anyone still use this? I didn't realize this was still actively maintained.

If you are using MySQL, and need to manually fuck around with tables for whatever reason, it's really useful and beats most other options. For us it sees plenty of use with poorly developed legacy software (e.g. Wordpress).

You might like this: https://www.dbninja.com/
Post reply on HN