phpMyAdmin Reflected File Download Attack
Summary
CVE-2016-6628: phpMyAdmin Reflected File Download attack. Affects phpmyadmin/phpmyadmin across 3 version ranges.
>= 4.0, < 4.0.10.17
>= 4.4, < 4.4.15.8
>= 4.6, < 4.6.4
Fixed in 4.0.10.17, 4.4.15.8 or 4.6.4, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Alpine:v3.2
The same CVE-2016-6628 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source administration tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks. This vulnerability affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17) of the phpMyAdmin package. The vulnerability allows an attacker to trick a user into downloading a specially crafted malicious SVG file.
Vulnerability Detail
The vulnerability in phpMyAdmin allows an attacker to exploit a reflected file download attack. By enticing a user to click on a malicious link or visit a specially crafted website, the attacker can trigger the download of a malicious SVG file. This file may contain executable code that can compromise the user's system or perform unauthorized actions. The vulnerability is considered moderate in severity with a CVSS score of 6.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0, < 4.0.10.174.0.10.17composer require phpmyadmin/phpmyadmin:4.0.10.17 -
>= 4.4, < 4.4.15.84.4.15.8composer require phpmyadmin/phpmyadmin:4.4.15.8 -
>= 4.6, < 4.6.44.6.4composer require phpmyadmin/phpmyadmin:4.6.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating phpMyAdmin to the latest patched version.
Conclusion
The phpMyAdmin Reflected File Download Attack vulnerability allows an attacker to trick users into downloading a malicious SVG file. To mitigate this vulnerability, it is recommended to update phpMyAdmin to the latest patched version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source administration tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
A reflected file download attack is a type of web-based attack where an attacker tricks a user into downloading a file from a malicious website. The file appears to be hosted by a trusted source, but it contains malicious code that can compromise the user's system.
An attacker can exploit this vulnerability by tricking a user into clicking on a malicious link or visiting a specially crafted website. This action triggers the download of a malicious SVG file, which may contain executable code that can compromise the user's system.
This vulnerability is considered moderate in severity with a CVSS score of 6.3.
No, there is no known workaround for this vulnerability. It is crucial to update phpMyAdmin to the latest patched version to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
