XSS Vulnerability in phpMyAdmin
Summary
CVE-2016-6615: XSS issues were discovered in phpMyAdmin. Affects phpmyadmin across 34 version ranges.
< 0fc00c0ab895cf83883ce43435f9563019e1b0f5
< 1c1753bb6666381fa2cd2cd1f160286935244a35
< 1f1e63cd5956eca847891b28b24e90ceaeaeb009
< 1fe735d098d82ad79500eab04c4d25ba8fe25a24
< 3fc737460caa3c47d9d51751d712cc8784b1dfef
< 4.4.15.8-r0
< 5b0543da6915bac44cb15e7e73f9e1886fe57588
< 6ab95d9bec50f6be6b5439abed35f99ab3fa5cbc
< 07fd0bce678e83d5f81d7a683f1052fe45764d0c
< 32f512698518214fcc59ea45e0f35b0aedff16cb
< 35e191d74b50c8f5a7b87fa9889869cc3a88255d
< 37b38431d167915675fc8ab512470528147e72de
< 66aba31923f26124e06b2a55b837e4fd47c5ef1d
< 73fd0dc2a8f5471c717a887aae22bde97bc5498f
< 78a6214afcee3a6b65eb5e1ac261aa8e70f36736
< 86a7d2704994c43a4fae11cf38105fc3cb3d4d5b
< 243ed0268fa15567c8a787eeb6055a232102b91a
< 409c9bc50aa447c52d334c839f4aa239f66c5e03
< 426c5d9c1ded024c9306428ce165ae82d6f6d5df
< 95104ff56e15876c6b481e09c9f0169e34b781f8
< a1b4ecc69bc4ac90a54e3f3c8644ca18f13b010d
< a6ecc52b3d1245a30d270d871992f2fedcf84be6
< a62fcf03af4c7f9df2393fbe58ae8653166763fa
< b0d60e271a6f47d2e0ecd81ad620b5d185acc0b1
< b7c2e99987c2c52c6e8010b55b75f3c1c039216a
< b478a3d5c4fc1341a0a77235d2afbd2b4e4d0a6c
< c21937440af0b0b2ed752f229c3d2523ac178d85
< d8f4a2d661f78281db7ee6826651ffc9574a2b31
< daf86cd1e369f63ad132d8dc63a7217267030408
< dba2af651a53d5037296a1dc827081a94ef1062c
< e4db51c0d47ac6e319ba93ce0d5706a33f736c00
< f2db92434b71973a1281dfbaec8837e51e602c77
< f7f483e99a74648843cc87265033442aeb4b7342
< fecf8b76ef831be0a5a8fddb1c3edf4251e92076
Fixed in 4.4.15.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular web-based administration tool for managing MySQL databases. It provides a user-friendly interface for performing various database operations such as creating, modifying, and deleting databases, tables, and queries. This vulnerability affects versions 4.6.x (prior to 4.6.4) and 4.4.x (prior to 4.4.15.8) of phpMyAdmin.
Vulnerability Detail
The vulnerability, identified as CVE-2016-6615, is related to cross-site scripting (XSS) issues in phpMyAdmin. There are multiple attack vectors for this vulnerability:
-
Navigation Pane and Database/Table Hiding: A specially-crafted database name can be used to trigger an XSS attack, potentially allowing an attacker to execute malicious scripts in the context of a user's browser.
-
Tracking Feature: A specially-crafted query can be used to trigger an XSS attack, potentially leading to the execution of arbitrary code in the user's browser.
-
GIS Visualization Feature: The GIS visualization feature is also affected by XSS vulnerabilities.
These vulnerabilities can be exploited by an attacker to steal sensitive information, perform unauthorized actions, or compromise the integrity of the affected system.
How To Fix
Minimum fixed version
4.4.15.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the affected features in phpMyAdmin until you are able to upgrade to a patched version. This can be done by modifying the configuration settings or by restricting access to the vulnerable features.
Conclusion
In conclusion, phpMyAdmin versions 4.6.x (prior to 4.6.4) and 4.4.x (prior to 4.4.15.8) are vulnerable to cross-site scripting (XSS) attacks. It is crucial to upgrade to the latest patched version to mitigate the risk of exploitation. For further assistance or support in resolving this vulnerability, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is a web-based administration tool for managing MySQL databases.
Versions 4.6.x (prior to 4.6.4) and 4.4.x (prior to 4.4.15.8) of phpMyAdmin are affected.
This vulnerability can be exploited by an attacker to execute malicious scripts, steal sensitive information, or perform unauthorized actions on the affected system.
To fix this vulnerability, it is recommended to upgrade to the latest version of phpMyAdmin (4.6.4 or later for version 4.6.x, and 4.4.15.8 or later for version 4.4.x).
Yes, you can temporarily disable the affected features in phpMyAdmin or restrict access to them until you are able to upgrade to a patched version.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
