#2144 Possibility to access phpmyadmin without proper credentials

[Brecht Kets]

When I 'logged on' with the username [ root" OR
1=1')-- ] and a blank password, I was able to gain
access to phpmyadmin. I got the same right's as
phpmyadmin uses to check credentials.

Cookie authentication was enabled.

[Michal Čihař]

Logged In: YES
user_id=192186

I can not reproduce this. Well if this works it looks like
bug rather in MySQL than in phpMyAdmin as phpMyAdmin only
connects to MySQL with credentials you enter in login form.

[Michal Čihař]

Logged In: YES
user_id=192186

What MySQL version do you use and what php extensions (mysql
or mysqli)?

[Brecht Kets]

Logged In: YES
user_id=1521613

for example: http://rabus.phpmyadmin.net/demos/RELEASE_FINAL/

i use this one because it's one from phpmyadmin.net

this site uses MySQL 5.0.20 with the mysqli extension.
I use MySQL 5.0.20 with the mysql extension

[Michal Čihař]

Logged In: YES
user_id=192186

There was security bug in MySQL 5.0.20 on handling login
names which has been fixed in 5.0.21 so I guess it is this
issue (as I can not reproduce it on 5.0.21 but I can confirm
it with 5.0.20).

[Jürgen Wind]

Logged In: YES
user_id=1383652

http://rabus.phpmyadmin.net/demos/RELEASE_FINAL/
works with any username, pw empty
:)