CVE-2016-9851: phpMyAdmin Bypass logout timeout
Summary
CVE-2016-9851: phpMyAdmin Bypass logout timeout. Affects phpmyadmin/phpmyadmin across 2 version ranges.
>= 4.4, < 4.4.15.9
>= 4.6, < 4.6.5
Fixed in 4.4.15.9 or 4.6.5, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Alpine:v3.2
The same CVE-2016-9851 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks. This vulnerability affects versions 4.6.x (prior to 4.6.5) and 4.4.x (prior to 4.4.15.9) of phpMyAdmin. The vulnerability allows an attacker to bypass the logout timeout, potentially leading to unauthorized access to the application.
Vulnerability Detail
The vulnerability in phpMyAdmin allows an attacker to bypass the logout timeout by sending a crafted request parameter value. This means that even after the user has logged out, an attacker can still access the application and perform actions on behalf of the user. The impact of this vulnerability depends on the privileges of the user and the actions they can perform within the application. It is important to note that this vulnerability only affects specific versions of phpMyAdmin.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.4, < 4.4.15.94.4.15.9composer require phpmyadmin/phpmyadmin:4.4.15.9 -
>= 4.6, < 4.6.54.6.5composer require phpmyadmin/phpmyadmin:4.6.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the patched versions of phpMyAdmin as soon as possible.
Conclusion
The vulnerability in phpMyAdmin allows an attacker to bypass the logout timeout and potentially gain unauthorized access to the application. To mitigate this vulnerability, it is recommended to upgrade to the patched versions of phpMyAdmin. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
Versions 4.6.x (prior to 4.6.5) and 4.4.x (prior to 4.4.15.9) of phpMyAdmin are affected by this vulnerability.
The vulnerability allows an attacker to bypass the logout timeout and potentially gain unauthorized access to the application.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the patched versions of phpMyAdmin.
To fix this vulnerability, upgrade to version 4.6.5 if you are using version 4.6.x, or to version 4.4.15.9 if you are using version 4.4.x of phpMyAdmin.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
