CVE-2018-10362
📋 TL;DR
This vulnerability allows authentication bypass in phpLiteAdmin by exploiting PHP's loose comparison operator. Attackers can log in with specially crafted passwords like '0e1234' or '2e2' that evaluate to numeric values matching the stored password hash. All users running phpLiteAdmin versions 1.9.5 through 1.9.7.1 are affected.
💻 Affected Systems
- phpLiteAdmin
📦 What is this software?
Phpliteadmin by Phpliteadmin
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the phpLiteAdmin database management interface, allowing attackers to read, modify, or delete databases, potentially leading to data loss or exposure of sensitive information.
Likely Case
Unauthorized access to database administration interface, enabling attackers to view or manipulate database contents depending on the specific deployment.
If Mitigated
No impact if proper authentication controls are in place or if the system is patched with strict comparison operators.
🎯 Exploit Status
Exploitation requires access to the login interface but no prior authentication. Attackers need to know or guess a valid username and craft a password that evaluates numerically to match the stored hash.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.7.2 and later
Vendor Advisory: https://github.com/phpLiteAdmin/pla/issues/11
Restart Required: No
Instructions:
1. Download phpLiteAdmin version 1.9.7.2 or later from the official repository. 2. Replace the existing installation files with the new version. 3. Verify the classes/Authorization.php file uses '===' instead of '==' for password comparison.
🔧 Temporary Workarounds
Manual code patch
linuxManually edit the vulnerable file to replace loose comparison with strict comparison
sed -i "s/== '\$password'/=== '\$password'/g" classes/Authorization.php
🧯 If You Can't Patch
- Disable phpLiteAdmin authentication entirely and rely on web server authentication
- Restrict access to phpLiteAdmin interface using IP whitelisting or network segmentation
🔍 How to Verify
Check if Vulnerable:
Check the classes/Authorization.php file for '==' comparison with $password variable instead of '==='Check Version:
grep 'Version' phpliteadmin.php | head -1Verify Fix Applied:
Verify the classes/Authorization.php file uses '===' for password comparison and test authentication with crafted passwords like '0e1234'📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful login with unusual password patterns
- Login attempts with passwords containing 'e' notation like '2e2', '0e1234'
Network Indicators:
- Unusual access patterns to phpLiteAdmin interface from unexpected sources
SIEM Query:
source="*phpliteadmin*" AND (event="login" OR event="authentication") AND (password="*e*" OR result="success")