Path Disclosure Vulnerability in phpMyAdmin
Summary
CVE-2016-9852: An issue was discovered in phpMyAdmin. Affects phpmyadmin across 34 version ranges.
< 1c1753bb6666381fa2cd2cd1f160286935244a35
< 1f1e63cd5956eca847891b28b24e90ceaeaeb009
< 1fe735d098d82ad79500eab04c4d25ba8fe25a24
< 3fc737460caa3c47d9d51751d712cc8784b1dfef
< 4.4.15.9-r0
< 5b0543da6915bac44cb15e7e73f9e1886fe57588
< 5b2b959a40ddd728d5ef4c6b09f118038c5e8af0
< 6ab95d9bec50f6be6b5439abed35f99ab3fa5cbc
< 07fd0bce678e83d5f81d7a683f1052fe45764d0c
< 32f512698518214fcc59ea45e0f35b0aedff16cb
< 35e191d74b50c8f5a7b87fa9889869cc3a88255d
< 37b38431d167915675fc8ab512470528147e72de
< 66aba31923f26124e06b2a55b837e4fd47c5ef1d
< 78a6214afcee3a6b65eb5e1ac261aa8e70f36736
< 86a7d2704994c43a4fae11cf38105fc3cb3d4d5b
< 243ed0268fa15567c8a787eeb6055a232102b91a
< 409c9bc50aa447c52d334c839f4aa239f66c5e03
< 426c5d9c1ded024c9306428ce165ae82d6f6d5df
< 95104ff56e15876c6b481e09c9f0169e34b781f8
< 39864227e7c33f9a6ef29890017e48164df54858
< a1b4ecc69bc4ac90a54e3f3c8644ca18f13b010d
< a62fcf03af4c7f9df2393fbe58ae8653166763fa
< b0d60e271a6f47d2e0ecd81ad620b5d185acc0b1
< b7c2e99987c2c52c6e8010b55b75f3c1c039216a
< b9a6a9993e175ff13375462333ce1139095d01e1
< b478a3d5c4fc1341a0a77235d2afbd2b4e4d0a6c
< c21937440af0b0b2ed752f229c3d2523ac178d85
< d8f4a2d661f78281db7ee6826651ffc9574a2b31
< daf86cd1e369f63ad132d8dc63a7217267030408
< dba2af651a53d5037296a1dc827081a94ef1062c
< e4db51c0d47ac6e319ba93ce0d5706a33f736c00
< f2db92434b71973a1281dfbaec8837e51e602c77
< f7f483e99a74648843cc87265033442aeb4b7342
< fecf8b76ef831be0a5a8fddb1c3edf4251e92076
Fixed in 4.4.15.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular web-based administration tool for managing MySQL databases. It provides a user-friendly interface for performing various database operations. The vulnerability identified as CVE-2016-9852 allows an attacker to trigger a PHP error message that reveals the full path of the directory where phpMyAdmin is installed. This information can be exploited by an attacker to gain further knowledge about the system and potentially launch more targeted attacks.
Vulnerability Detail
The vulnerability arises due to the improper handling of scripts in phpMyAdmin. By invoking certain scripts in an unexpected manner, an attacker can cause phpMyAdmin to display a PHP error message containing the installation directory's full path. This issue specifically affects versions 4.6.x (prior to 4.6.5) and 4.4.x (prior to 4.4.15.9) of phpMyAdmin. During an execution timeout in the export functionality, the error messages containing the full path are written to the export file. This vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
4.4.15.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the export functionality in phpMyAdmin to mitigate the risk of path disclosure. This can be achieved by modifying the configuration settings or removing the export feature from the user interface. However, it is strongly recommended to apply the official updates as soon as possible.
Conclusion
The path disclosure vulnerability in phpMyAdmin can potentially expose sensitive information about the system's directory structure. It is crucial to promptly update to the latest version of phpMyAdmin to mitigate this risk. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is a web-based administration tool for managing MySQL databases. It allows users to perform various database operations through a user-friendly interface.
The vulnerability allows an attacker to obtain the full path of the phpMyAdmin installation directory. This information can be used to gain further knowledge about the system and potentially launch more targeted attacks.
Versions 4.6.x (prior to 4.6.5) and 4.4.x (prior to 4.4.15.9) of phpMyAdmin are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to the latest version of phpMyAdmin (4.6.5 or later for 4.6.x versions, and 4.4.15.9 or later for 4.4.x versions).
Yes, a temporary workaround is to disable the export functionality in phpMyAdmin. However, it is strongly advised to apply the official updates as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
