1. Home
  2. Common Vulnerabilities and Exposures
  3. CRLF/HTML entity injection with most recent version of PHPMyAdmin #16056

CRLF/HTML entity injection with most recent version of PHPMyAdmin #16056

 

Overview :
** DISPUTED ** phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states “I don’t see anything specifically exploitable.”

CVE-2020-11441

 

CRLF/HTML entity injection with most recent version of PHPMyAdmin #16056

Describe the bug

The login form does not properly escape CRLF sequences, this can lead to HTML entity injection at the very least, or reflected XSS at the very worst.

To Reproduce

Steps to reproduce the behavior:

  1. Go to ‘index.php’
  2. Insert into the login fields, username, password, and the hidden field of target, and insert this value into those fields: %0D%0Astring%0D%0A and the login error will display the injected CRLF sequences, and injected url encoded entities, such as single or double quotes(double quotes are not as effective as single quotes).

Expected behavior

I expected the application to drop/filter out the CRLF sequences seeing as an issue similar was detected back in 2005.

Server configuration

  • Operating system: Ubuntu
  • Web server: Apache
  • Database version: MySQL
  • PHP version: most recent.
  • phpMyAdmin version: most recent.

Client configuration

  • Browser: Firefox
  • Operating system: Windows 10

 

Common Vulnerabilityies and Exposures

Internet Download Manager 6.37.11.1 Export/Import stack-based overflow

A vulnerability, which was classified as critical, was found in Internet Download Manager 6.37.11.1. This affects an unknown code block of the component Export/Import. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Learn more

Passcovery ZIP Password Recovery 3.70.69.0 Decompression buffer overflow

A vulnerability classified as critical was found in Passcovery ZIP Password Recovery 3.70.69.0. Affected by this vulnerability is an unknown part of the component Decompression. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Learn more

Portable Playable 9.18 JPEG File filename unrestricted upload

A vulnerability, which was classified as critical, has been found in Portable Playable 9.18. Affected by this issue is an unknown code of the component JPEG File Handler. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Learn more