Description
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
phpMyAdmin phpMyAdmin
Default version status: unaffected
0 to ≤ 5.2.3affected
pkg:composer/phpmyadmin/phpmyadminReferences
- https://github.com/phpmyadmin/phpmyadmin/commit/b2a3e41f1e9ce42d1ee3f07a91f476029987799f ↗
- https://github.com/phpmyadmin/phpmyadmin/commit/6482dfa28bd56d515f482b008b194a516646fe1b ↗
- https://github.com/phpmyadmin/phpmyadmin/pull/19087 ↗
- https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Controllers/Config/SetConfigController.php#L29-L41 ↗
- https://abraxaslabs.tech/research/phpmyadmin-config-set-2fa ↗
- https://github.com/phpmyadmin/phpmyadmin ↗
- https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-two-factor-authentication-removal-via-config-set ↗