CVE-2016-5734: phpMyAdmin Code Injection Vulnerability
Summary
CVE-2016-5734: phpMyAdmin Code Injection vulnerability. Affects phpmyadmin/phpmyadmin across 3 version ranges.
>= 4.0.10.0, < 4.0.10.16
>= 4.4.15.0, < 4.4.15.7
>= 4.6.0, < 4.6.3
Fixed in 4.0.10.16, 4.4.15.7 or 4.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2016-5734 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely used open-source tool for managing MySQL databases through a web interface. It provides a user-friendly way to perform database operations such as creating, modifying, and deleting databases and tables. However, certain versions of phpMyAdmin are vulnerable to a code injection flaw that can allow remote attackers to execute arbitrary PHP code.
Vulnerability Detail
The vulnerability arises from improper delimiter selection in the preg_replace function, which can lead to the use of the eval modifier. This flaw exists in phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3. Attackers can exploit this vulnerability by crafting a malicious string that, when processed, executes arbitrary PHP code on the server, potentially compromising the entire application and its data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.10.0, < 4.0.10.164.0.10.16composer require phpmyadmin/phpmyadmin:4.0.10.16 -
>= 4.4.15.0, < 4.4.15.74.4.15.7composer require phpmyadmin/phpmyadmin:4.4.15.7 -
>= 4.6.0, < 4.6.34.6.3composer require phpmyadmin/phpmyadmin:4.6.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not possible, consider restricting access to the phpMyAdmin interface by implementing IP whitelisting or using a VPN to limit exposure. Additionally, ensure that your web server is configured to prevent unauthorized access to sensitive files.
Conclusion
The phpMyAdmin code injection vulnerability (CVE-2016-5734) poses a significant risk to users of affected versions. Immediate action is recommended to update to the latest patched versions to mitigate potential exploitation. Regular monitoring and access controls can further enhance security.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
The vulnerability affects phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to execute arbitrary PHP code, which may compromise the server and its data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
If you cannot update immediately, consider implementing access restrictions and monitoring your application for suspicious activity until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
