Critical Vulnerability in phpMyAdmin: Exposure of HttpOnly Cookies
Summary
ALPINE-CVE-2016-9848: An issue was discovered in phpMyAdmin. Affects phpmyadmin versions < 4.4.15.9-r0. Fixed in 4.4.15.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely used open-source tool for managing MySQL databases through a web interface. It allows users to perform various database operations, such as creating, modifying, and deleting databases and tables, executing SQL queries, and managing user permissions. Despite its popularity, phpMyAdmin has faced security challenges, including vulnerabilities that can expose sensitive information.
Vulnerability Detail
An issue was discovered in phpMyAdmin where the phpinfo function (located in phpinfo.php) reveals PHP configuration details, including the values of HttpOnly cookies. This vulnerability affects all versions of phpMyAdmin 4.6.x prior to 4.6.5, 4.4.x prior to 4.4.15.9, and 4.0.x prior to 4.0.10.18. The exposure of HttpOnly cookies can lead to session hijacking and unauthorized access to user accounts, posing a significant security risk.
How To Fix
Minimum fixed version
4.4.15.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the phpinfo functionality in your phpMyAdmin installation until you can apply the patch. This can be done by removing or renaming the phpinfo.php file in the phpMyAdmin directory.
Conclusion
The vulnerability in phpMyAdmin poses a significant risk by exposing sensitive cookie information. It is crucial for users to update to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in real-time, ensuring ongoing security.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is an open-source web-based application that allows users to manage MySQL databases easily.
The vulnerability exposes the values of HttpOnly cookies, which can lead to session hijacking.
You can check your phpMyAdmin version and compare it against the affected versions listed in the vulnerability report.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
Vulert monitors and alerts in real-time for open-source vulnerabilities using a manifest file like package-lock.json, allowing you to keep your software secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
