CVE-2016-5701: phpMyAdmin Cross-site Scripting Vulnerability
Summary
CVE-2016-5701: phpMyAdmin vulnerable to Cross-site Scripting. Affects phpmyadmin/phpmyadmin across 3 version ranges.
>= 4.0.10.0, < 4.0.10.16
>= 4.4.15.0, < 4.4.15.7
>= 4.6.0, < 4.6.3
Fixed in 4.0.10.16, 4.4.15.7 or 4.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2016-5701 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely-used open-source tool for managing MySQL databases through a web interface. It allows users to perform various database operations such as creating, modifying, and deleting databases and tables. The tool is known for its user-friendly interface and extensive features, making it a popular choice among developers and database administrators. However, certain versions of phpMyAdmin are vulnerable to a Cross-site Scripting (XSS) attack, which can compromise user sessions and lead to unauthorized actions.
Vulnerability Detail
The vulnerability exists in the setup/frames/index.inc.php file of phpMyAdmin versions 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3. It allows remote attackers to conduct BBCode injection attacks via a crafted URI. This can lead to the execution of malicious scripts in the context of the user's session, potentially exposing sensitive information or allowing unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.10.0, < 4.0.10.164.0.10.16composer require phpmyadmin/phpmyadmin:4.0.10.16 -
>= 4.4.15.0, < 4.4.15.74.4.15.7composer require phpmyadmin/phpmyadmin:4.4.15.7 -
>= 4.6.0, < 4.6.34.6.3composer require phpmyadmin/phpmyadmin:4.6.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict access to the phpMyAdmin interface by implementing IP whitelisting or using a web application firewall to filter malicious requests. However, this does not eliminate the vulnerability and should only be considered until a proper update can be applied.
Conclusion
The CVE-2016-5701 vulnerability in phpMyAdmin poses a significant risk due to its potential for Cross-site Scripting attacks. It is crucial for users of affected versions to update to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their sessions.
The affected versions are phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability can allow attackers to hijack user sessions, steal sensitive information, or perform unauthorized actions on behalf of the user.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
