phpMyAdmin Authentication Bypass Vulnerability in Specific PHP Versions

CVE-2017-18264

Summary

An issue has been identified in the phpMyAdmin application, where the settings intended to restrict access to users without a password can be circumvented under certain PHP versions (e.g., version 5). Specifically, despite the configuration settings ($cfg['Servers'][$i]['AllowNoPassword']) being set to disallow such logins, the actual user authentication can still succeed. This flaw results from particular implementations of the PHP substr function, which may erroneously return false when provided with an empty string as the first argument. This vulnerability poses a significant risk as it may allow unauthorized access to database systems, highlighting the need for immediate attention and remediation.

References