CVE-2016-6618: phpMyAdmin Denial of Service (DOS) Attack in Transformation Feature
Summary
CVE-2016-6618: phpMyAdmin Denial of service (DOS) attack in transformation feature. Affects phpmyadmin/phpmyadmin across 3 version ranges.
>= 4.0, < 4.0.10.17
>= 4.4, < 4.4.15.8
>= 4.6, < 4.6.4
Fixed in 4.0.10.17, 4.4.15.8 or 4.6.4, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Alpine:v3.2
The same CVE-2016-6618 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is an open-source web-based administration tool for managing MySQL and MariaDB databases. It provides a user-friendly interface for performing various database operations such as creating, modifying, and deleting databases, tables, and records. The transformation feature in phpMyAdmin allows users to apply various transformations to the data displayed in the interface. These transformations can be used to format, filter, or manipulate the data. However, a vulnerability in this feature allows an attacker to trigger a denial-of-service (DoS) attack against the server.
Vulnerability Detail
The vulnerability in phpMyAdmin's transformation feature allows an attacker to exploit the server's resources and cause a DoS condition. By sending specially crafted requests to the server, an attacker can overwhelm the server's processing capabilities, leading to a complete or partial unavailability of the service. This vulnerability affects all versions of phpMyAdmin 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17). The impact of this vulnerability can range from temporary service disruption to prolonged downtime, depending on the server's configuration and the attacker's resources.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0, < 4.0.10.174.0.10.17composer require phpmyadmin/phpmyadmin:4.0.10.17 -
>= 4.4, < 4.4.15.84.4.15.8composer require phpmyadmin/phpmyadmin:4.4.15.8 -
>= 4.6, < 4.6.44.6.4composer require phpmyadmin/phpmyadmin:4.6.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the transformation feature in phpMyAdmin to prevent the exploitation of this vulnerability. This can be done by modifying the configuration file or using the phpMyAdmin interface to disable the feature. However, disabling the transformation feature may limit certain functionalities and should only be considered as a temporary measure until the software is updated to a patched version.
Conclusion
The vulnerability in phpMyAdmin's transformation feature can be exploited to trigger a denial-of-service (DoS) attack against the server. It is crucial to upgrade phpMyAdmin to the latest patched version to mitigate this vulnerability. Disabling the transformation feature can serve as a temporary workaround, but it is recommended to update the software as soon as possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source web-based administration tool for managing MySQL and MariaDB databases. It provides a user-friendly interface for performing various database operations.
The transformation feature in phpMyAdmin allows users to apply various transformations to the data displayed in the interface. These transformations can be used to format, filter, or manipulate the data.
The vulnerability in the transformation feature allows an attacker to trigger a denial-of-service (DoS) attack against the server. By exploiting this vulnerability, an attacker can overwhelm the server's resources and cause a complete or partial unavailability of the service.
All versions of phpMyAdmin 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17) are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade phpMyAdmin to the latest patched version (4.6.4, 4.4.15.8, or 4.0.10.17). Regularly updating phpMyAdmin is important to ensure the latest security fixes are applied.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
