Path Disclosure Vulnerability in phpMyAdmin
Summary
CVE-2016-9853: An issue was discovered in phpMyAdmin. Affects phpmyadmin across 34 version ranges.
< 1c1753bb6666381fa2cd2cd1f160286935244a35
< 1f1e63cd5956eca847891b28b24e90ceaeaeb009
< 1fe735d098d82ad79500eab04c4d25ba8fe25a24
< 3fc737460caa3c47d9d51751d712cc8784b1dfef
< 4.4.15.9-r0
< 5b0543da6915bac44cb15e7e73f9e1886fe57588
< 5b2b959a40ddd728d5ef4c6b09f118038c5e8af0
< 6ab95d9bec50f6be6b5439abed35f99ab3fa5cbc
< 07fd0bce678e83d5f81d7a683f1052fe45764d0c
< 32f512698518214fcc59ea45e0f35b0aedff16cb
< 35e191d74b50c8f5a7b87fa9889869cc3a88255d
< 37b38431d167915675fc8ab512470528147e72de
< 66aba31923f26124e06b2a55b837e4fd47c5ef1d
< 78a6214afcee3a6b65eb5e1ac261aa8e70f36736
< 86a7d2704994c43a4fae11cf38105fc3cb3d4d5b
< 243ed0268fa15567c8a787eeb6055a232102b91a
< 409c9bc50aa447c52d334c839f4aa239f66c5e03
< 426c5d9c1ded024c9306428ce165ae82d6f6d5df
< 95104ff56e15876c6b481e09c9f0169e34b781f8
< 39864227e7c33f9a6ef29890017e48164df54858
< a1b4ecc69bc4ac90a54e3f3c8644ca18f13b010d
< a62fcf03af4c7f9df2393fbe58ae8653166763fa
< b0d60e271a6f47d2e0ecd81ad620b5d185acc0b1
< b7c2e99987c2c52c6e8010b55b75f3c1c039216a
< b9a6a9993e175ff13375462333ce1139095d01e1
< b478a3d5c4fc1341a0a77235d2afbd2b4e4d0a6c
< c21937440af0b0b2ed752f229c3d2523ac178d85
< d8f4a2d661f78281db7ee6826651ffc9574a2b31
< daf86cd1e369f63ad132d8dc63a7217267030408
< dba2af651a53d5037296a1dc827081a94ef1062c
< e4db51c0d47ac6e319ba93ce0d5706a33f736c00
< f2db92434b71973a1281dfbaec8837e51e602c77
< f7f483e99a74648843cc87265033442aeb4b7342
< fecf8b76ef831be0a5a8fddb1c3edf4251e92076
Fixed in 4.4.15.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular web-based administration tool for managing MySQL databases. It provides a user-friendly interface to perform various database operations such as creating tables, executing queries, and managing user permissions. This vulnerability affects versions 4.6.x (prior to 4.6.5) and 4.4.x (prior to 4.4.15.9) of phpMyAdmin.
Vulnerability Detail
The vulnerability, identified as CVE-2016-9853, allows an attacker to trigger phpMyAdmin to display a PHP error message that reveals the full path of the directory where phpMyAdmin is installed. This disclosure occurs when certain scripts within phpMyAdmin are called in an unexpected manner. Additionally, during an execution timeout in the export functionality, the errors containing the full path are written to the export file. This information disclosure can aid attackers in further exploiting the system.
How To Fix
Minimum fixed version
4.4.15.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating phpMyAdmin is not immediately feasible, a temporary workaround is to disable the display of PHP errors in the production environment. This can be achieved by modifying the PHP configuration settings to set 'display_errors' to 'Off'. However, it is crucial to keep in mind that this workaround only hides the error messages and does not fix the underlying vulnerability.
Conclusion
The path disclosure vulnerability in phpMyAdmin can lead to the exposure of sensitive information about the installation directory. It is crucial to update phpMyAdmin to the latest version to mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is a web-based administration tool for managing MySQL databases. It provides an intuitive interface to perform various database operations.
All versions of phpMyAdmin 4.6.x (prior to 4.6.5) and 4.4.x (prior to 4.4.15.9) are affected.
By triggering phpMyAdmin to display a PHP error message, an attacker can obtain the full path of the directory where phpMyAdmin is installed. This information can be used to plan further attacks on the system.
The disclosure of the installation directory path can aid attackers in identifying the underlying technology stack and potentially exploit other vulnerabilities in the system.
A temporary workaround is to disable the display of PHP errors in the production environment by modifying the PHP configuration settings.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
