Path Disclosure Vulnerability in phpMyAdmin
Summary
CVE-2016-9854: An issue was discovered in phpMyAdmin. Affects phpmyadmin across 34 version ranges.
< 1c1753bb6666381fa2cd2cd1f160286935244a35
< 1f1e63cd5956eca847891b28b24e90ceaeaeb009
< 1fe735d098d82ad79500eab04c4d25ba8fe25a24
< 3fc737460caa3c47d9d51751d712cc8784b1dfef
< 4.4.15.9-r0
< 5b0543da6915bac44cb15e7e73f9e1886fe57588
< 5b2b959a40ddd728d5ef4c6b09f118038c5e8af0
< 6ab95d9bec50f6be6b5439abed35f99ab3fa5cbc
< 07fd0bce678e83d5f81d7a683f1052fe45764d0c
< 32f512698518214fcc59ea45e0f35b0aedff16cb
< 35e191d74b50c8f5a7b87fa9889869cc3a88255d
< 37b38431d167915675fc8ab512470528147e72de
< 66aba31923f26124e06b2a55b837e4fd47c5ef1d
< 78a6214afcee3a6b65eb5e1ac261aa8e70f36736
< 86a7d2704994c43a4fae11cf38105fc3cb3d4d5b
< 243ed0268fa15567c8a787eeb6055a232102b91a
< 409c9bc50aa447c52d334c839f4aa239f66c5e03
< 426c5d9c1ded024c9306428ce165ae82d6f6d5df
< 95104ff56e15876c6b481e09c9f0169e34b781f8
< 39864227e7c33f9a6ef29890017e48164df54858
< a1b4ecc69bc4ac90a54e3f3c8644ca18f13b010d
< a62fcf03af4c7f9df2393fbe58ae8653166763fa
< b0d60e271a6f47d2e0ecd81ad620b5d185acc0b1
< b7c2e99987c2c52c6e8010b55b75f3c1c039216a
< b9a6a9993e175ff13375462333ce1139095d01e1
< b478a3d5c4fc1341a0a77235d2afbd2b4e4d0a6c
< c21937440af0b0b2ed752f229c3d2523ac178d85
< d8f4a2d661f78281db7ee6826651ffc9574a2b31
< daf86cd1e369f63ad132d8dc63a7217267030408
< dba2af651a53d5037296a1dc827081a94ef1062c
< e4db51c0d47ac6e319ba93ce0d5706a33f736c00
< f2db92434b71973a1281dfbaec8837e51e602c77
< f7f483e99a74648843cc87265033442aeb4b7342
< fecf8b76ef831be0a5a8fddb1c3edf4251e92076
Fixed in 4.4.15.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular web-based administration tool for managing MySQL databases. It provides a user-friendly interface to perform various database operations such as creating, modifying, and deleting databases, tables, and records. The vulnerability in question allows an attacker to trigger a PHP error message that reveals the full path of the directory where phpMyAdmin is installed.
Vulnerability Detail
The vulnerability arises due to an unexpected usage of certain scripts in phpMyAdmin. When the export functionality encounters an execution timeout, error messages containing the full path of the phpMyAdmin directory are written to the export file. This information disclosure can aid attackers in planning further attacks or gaining unauthorized access to the system. The vulnerability affects phpMyAdmin versions 4.6.x (prior to 4.6.5) and 4.4.x (prior to 4.4.15.9).
How To Fix
Minimum fixed version
4.4.15.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the export functionality in phpMyAdmin. This can be achieved by modifying the configuration or access control settings to restrict access to the export feature.
Conclusion
The path disclosure vulnerability in phpMyAdmin can be mitigated by upgrading to the latest patched version or by temporarily disabling the export functionality. It is crucial to promptly address this vulnerability to prevent potential unauthorized access or further attacks. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is a web-based administration tool for managing MySQL databases.
The vulnerability allows an attacker to obtain the full path of the phpMyAdmin directory, which can aid in planning further attacks or unauthorized access.
The vulnerability affects phpMyAdmin versions 4.6.x (prior to 4.6.5) and 4.4.x (prior to 4.4.15.9).
To fix this vulnerability, upgrade to phpMyAdmin version 4.6.5 or later for 4.6.x installations, and version 4.4.15.9 or later for 4.4.x installations.
Yes, you can temporarily disable the export functionality in phpMyAdmin until you can upgrade to a patched version.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
