CVE-2016-6633: phpMyAdmin Remote Code Execution Vulnerability
Summary
CVE-2016-6633: phpMyAdmin Remote code execution vulnerability when PHP is running with dbase extension. Affects phpmyadmin/phpmyadmin across 3 version ranges.
>= 4.0, < 4.0.10.17
>= 4.4, < 4.4.15.8
>= 4.6, < 4.6.4
Fixed in 4.0.10.17, 4.4.15.8 or 4.6.4, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Alpine:v3.2
The same CVE-2016-6633 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool used for managing MySQL databases through a web interface. It provides a user-friendly interface for performing various database operations such as creating, modifying, and deleting databases, tables, and records. The tool is widely used by developers, database administrators, and website owners to manage their MySQL databases efficiently. However, a vulnerability has been discovered in phpMyAdmin that allows for remote code execution when PHP is running with the dbase extension.
Vulnerability Detail
The vulnerability (CVE-2016-6633) in phpMyAdmin allows an attacker to execute arbitrary code remotely on certain PHP installations that have the dbase extension enabled. This vulnerability affects all versions of phpMyAdmin 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17). By exploiting this vulnerability, an attacker can execute malicious code on the server, potentially leading to unauthorized access, data theft, or further compromise of the system. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.1.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0, < 4.0.10.174.0.10.17composer require phpmyadmin/phpmyadmin:4.0.10.17 -
>= 4.4, < 4.4.15.84.4.15.8composer require phpmyadmin/phpmyadmin:4.4.15.8 -
>= 4.6, < 4.6.44.6.4composer require phpmyadmin/phpmyadmin:4.6.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to immediately update phpMyAdmin, you can mitigate the risk by disabling the dbase extension in your PHP configuration. This can be done by modifying the php.ini file and commenting out or removing the line that enables the dbase extension. After making the changes, restart your web server for the changes to take effect. However, it is strongly recommended to update to the latest version of phpMyAdmin as soon as possible.
Conclusion
The phpMyAdmin Remote Code Execution vulnerability (CVE-2016-6633) poses a significant risk to PHP installations running with the dbase extension. It is crucial to update phpMyAdmin to version 4.6.4 or later to mitigate this vulnerability. Alternatively, disabling the dbase extension can provide temporary protection. Regularly monitoring for vulnerabilities in your software stack is essential to ensure the security of your applications. For real-time monitoring and alerts for open-source vulnerabilities, you can use Vulert (https://vulert.com). For further assistance or support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool used for managing MySQL databases through a web interface. It provides a user-friendly interface for performing various database operations.
This vulnerability allows an attacker to execute arbitrary code remotely on certain PHP installations that have the dbase extension enabled. It can lead to unauthorized access, data theft, or further compromise of the system.
All versions of phpMyAdmin 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17) are affected.
To fix this vulnerability, update phpMyAdmin to version 4.6.4 or later. Alternatively, you can disable the dbase extension in your PHP configuration.
You can download the latest version of phpMyAdmin from the official website at https://www.phpmyadmin.net/downloads/
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
