CVE-2016-9866: phpMyAdmin CSRF Vulnerability
Summary
CVE-2016-9866: phpMyAdmin CSRF Vulnerability. Affects phpmyadmin/phpmyadmin across 3 version ranges.
>= 4.0.0, < 4.0.10.18
>= 4.4.0, < 4.4.15.9
>= 4.6.0, < 4.6.5
Fixed in 4.0.10.18, 4.4.15.9 or 4.6.5, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Alpine:v3.2
The same CVE-2016-9866 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source administration tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks. This vulnerability affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18) of phpMyAdmin. The vulnerability arises when the arg_separator is set to a value other than the default '&'.
Vulnerability Detail
The vulnerability in phpMyAdmin allows for Cross-Site Request Forgery (CSRF) attacks. When the arg_separator is not the default value, the CSRF token is not properly stripped from the return URL of the preference import action. This allows an attacker to trick a user into performing unintended actions on their behalf. The impact of this vulnerability can be severe, as it can lead to unauthorized modification or deletion of database content.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.0.10.184.0.10.18composer require phpmyadmin/phpmyadmin:4.0.10.18 -
>= 4.4.0, < 4.4.15.94.4.15.9composer require phpmyadmin/phpmyadmin:4.4.15.9 -
>= 4.6.0, < 4.6.54.6.5composer require phpmyadmin/phpmyadmin:4.6.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately feasible, a temporary workaround is to manually modify the phpMyAdmin configuration to set the arg_separator to the default value '&'. This can be done by editing the configuration file or using the phpMyAdmin interface to change the configuration settings.
Conclusion
The phpMyAdmin CSRF vulnerability (CVE-2016-9866) poses a significant risk to the security of MySQL databases. It allows for CSRF attacks, which can lead to unauthorized modification or deletion of database content. It is crucial to upgrade to the latest version of phpMyAdmin or apply the temporary workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source administration tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
Cross-Site Request Forgery (CSRF) is an attack that tricks a user into performing unintended actions on a web application in which they are authenticated. It can lead to unauthorized actions being performed on behalf of the user.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your phpMyAdmin version is affected by this vulnerability. Simply upload your composer.lock file and it will provide you with real-time alerts for open-source vulnerabilities.
The vulnerability allows for CSRF attacks, which can lead to unauthorized modification or deletion of database content. This can result in data loss, unauthorized access, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade to the latest version of phpMyAdmin. Alternatively, you can apply the temporary workaround of setting the arg_separator to the default value '&'.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
