VulertSecurity VulertSecurity

CVE-2016-6624: phpMyAdmin IPv6 and proxy server IP-based authentication rule circumvention

phpmyadmin/phpmyadmin Updated 02 Oct 2025

Summary

17/05/2022
CVE-2016-6624
Yes i
Moderate
5.9

CVE-2016-6624: phpMyAdmin IPv6 and proxy server IP-based authentication rule circumvention. Affects phpmyadmin/phpmyadmin across 3 version ranges.

>= 4.0, < 4.0.10.17 >= 4.4, < 4.4.15.8 >= 4.6, < 4.6.4

Fixed in 4.0.10.17, 4.4.15.8 or 4.6.4, depending on the release line you run. How to fix ↓

Also tracked for

The same CVE-2016-6624 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats
SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml
Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile
Javascript package-lock.json · yarn.lock · pnpm-lock.yaml
PHP composer.lock
Python poetry.lock · requirements.txt · Pipfile.lock
Go go.mod
Rust Cargo.lock
Ruby Gemfile.lock
Dart pubspec.lock
C/C++ conan.lock
Elixir mix.lock
Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

A free account is created for continuous monitoring. By scanning, you agree to our Terms & Conditions.

Sponsored MarkAI Find prospects already talking about the problem you solve AI watches the communities your customers use to find qualified prospects, then alerts you when a conversation is worth joining. See MarkAI

Background

phpMyAdmin is a popular open-source administration tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks. The tool is widely used by developers, database administrators, and website owners to interact with their MySQL databases. However, a vulnerability has been discovered in phpMyAdmin that allows for the circumvention of IP-based authentication rules when used with IPv6 in a proxy server environment.

Vulnerability Detail

The vulnerability arises from the improper enforcement of IP-based authentication rules in phpMyAdmin. In a scenario where phpMyAdmin is configured to use IPv6 in a proxy server environment, and the proxy server is within the allowed IP range but the attacking computer is not allowed, this vulnerability can be exploited to allow the attacking computer to connect despite the IP rules. This vulnerability affects all versions of phpMyAdmin 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17). The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.9.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

  • >= 4.0, < 4.0.10.17 4.0.10.17 
    composer require phpmyadmin/phpmyadmin:4.0.10.17
  • >= 4.4, < 4.4.15.8 4.4.15.8 
    composer require phpmyadmin/phpmyadmin:4.4.15.8
  • >= 4.6, < 4.6.4 4.6.4 
    composer require phpmyadmin/phpmyadmin:4.6.4

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

If updating phpMyAdmin is not immediately feasible, a temporary workaround is to disable IPv6 support in the proxy server environment. By disabling IPv6, the vulnerability can be mitigated as the proxy server will no longer handle IPv6 connections. However, this workaround may not be suitable for all environments and should be thoroughly tested before implementation.

Conclusion

In conclusion, phpMyAdmin is vulnerable to an IP-based authentication rule circumvention when used with IPv6 in a proxy server environment. This vulnerability can allow unauthorized access to the administration tool. It is recommended to update phpMyAdmin to the latest patched version or disable IPv6 support in the proxy server environment as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for phpmyadmin/phpmyadmin →

Share this vulnerability

FAQ

What is phpMyAdmin?

phpMyAdmin is an open-source administration tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.

IP-based authentication is a security mechanism that allows or denies access to a system based on the IP address of the connecting device. In the case of phpMyAdmin, it is used to control access to the administration tool based on the IP address of the client.

This vulnerability allows for the circumvention of IP-based authentication rules in phpMyAdmin when used with IPv6 in a proxy server environment. An attacking computer can connect to phpMyAdmin despite not being allowed based on the IP rules.

All versions of phpMyAdmin 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17) are affected by this vulnerability.

The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.9.

References

View More

Related vulnerabilities

Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.

View all phpmyadmin/phpmyadmin vulnerabilities →
Sponsored MarkAI Find prospects already talking about the problem you solve AI watches the communities your customers use to find qualified prospects, then alerts you when a conversation is worth joining. See MarkAI

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

  • >= 4.0, < 4.0.10.17 4.0.10.17 
    composer require phpmyadmin/phpmyadmin:4.0.10.17
  • >= 4.4, < 4.4.15.8 4.4.15.8 
    composer require phpmyadmin/phpmyadmin:4.4.15.8
  • >= 4.6, < 4.6.4 4.6.4 
    composer require phpmyadmin/phpmyadmin:4.6.4

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →
Help improve this record
Report an issue or send feedback

Follow Vulert in Google

Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.

Add Vulert as a Preferred Source