Can't login to phpmyadmin (possibly related to a phpMyAdmin vulnerability)

[voidzero]

Hi,

For some reason my server crashed. When I brought it back up I found no real problems or inconsistencies, but when tried to visit phpmyadmin I get:

1045 - Access denied for user 'root'@'localhost' (using password: NO)
Invalid hostname for server 1. Please review your configuration.

Any way to solve this?

[voidzero]

By the way, this shows everytime, i can't even try to login, it happens as soon as i open phpmyadmin.

[till]

Make sure that you close all browser windows and then open the browser again before you connect to phpmyadmin.

[manarak]

I have exactly the same problem.

It appeared out of nowhere, maybe after I did an update.

I tried what you suggested, but it seems clear that this is a server problem.

[voidzero]

exactly, manarak!

Anyway, what I did as a workaround was:

1. Edit /var/lib/phpmyadmin/config.inc.php;
2. Change the option value 'config' to 'cookie'.

I'm still getting the error "Invalid hostname for server 1. Please review your configuration." but at least I can login again.

[manarak]

cool, thanks - it would still be interesting to find out what broke phpmyadmin though.

[manarak]

ok, it looks like the config file was changed, the hostname is commented out and there is a phpinfo(); in its place.

that could be an injection attack ?

is there a known vulnerability?

[till]

is there a known vulnerability?

Which software do you mean? ISPConfig or phpmyadmin? In ISPConfig there are no known vulnerabilities.

Which config file was changed?

[manarak]

yes there is:

http://www.gnucitizen.org/blog/cve-2...of-of-concept/

we have been injected !!

[till]

Make sure that you install all available debian updates. phpmyadmin is part of debian and not part of ispconfig.