From b69311e460bd52eebc4402a165c012e63121ef03 Mon Sep 17 00:00:00 2001 From: Deven Bansod Date: Wed, 16 Nov 2016 11:06:29 +0530 Subject: [PATCH 1/2] Fix self-injection in Table specific privileges Don't manually add backticks (`) rather use the Util function, since escaping of backticks inside the column_name has to be handled too. Fix #12361 Signed-off-by: Deven Bansod --- libraries/server_privileges.lib.php | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/libraries/server_privileges.lib.php b/libraries/server_privileges.lib.php index 17a88edf3a..c328dd492a 100644 --- a/libraries/server_privileges.lib.php +++ b/libraries/server_privileges.lib.php @@ -187,8 +187,16 @@ function PMA_extractPrivInfo($row = null, $enableHTML = false, $tablePrivs = fal && is_array($GLOBALS[$current_grant[0]]) && empty($GLOBALS[$current_grant[0] . '_none']) ) { + // Required for proper escaping of ` (backtick) in a column name + $grant_cols = array_map( + function($val) { + return Util::backquote($val); + }, + $GLOBALS[$current_grant[0]] + ); + $privs[] = PMA_formatPrivilege($current_grant, $enableHTML) - . ' (`' . join('`, `', $GLOBALS[$current_grant[0]]) . '`)'; + . ' (' . join(', ', $grant_cols) . ')'; } else { $allPrivileges = false; } From 88b284816cdcbb3783685785f887faa061d0bd07 Mon Sep 17 00:00:00 2001 From: Deven Bansod Date: Wed, 16 Nov 2016 11:12:05 +0530 Subject: [PATCH 2/2] ChangeLog for #12361 Signed-off-by: Deven Bansod Conflicts: ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index b5030eacb0..d0d87cd41d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -90,6 +90,7 @@ phpMyAdmin - ChangeLog - issue #12691 Remove ksort call on empty array in PMA_getPlugins function - issue #12443 Check parameter type before processing - issue #12299 Avoid generating too long URLs in search +- issue #12361 Fix self SQL injection in table-specific privileges 4.6.4 (2016-08-16) - issue [security] Weaknesses with cookie encryption, see PMASA-2016-29