XSS Vulnerability in phpMyAdmin
Summary
CVE-2016-9856: An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. Affects phpmyadmin across 64 version ranges.
< 1c1753bb6666381fa2cd2cd1f160286935244a35
< 1f1e63cd5956eca847891b28b24e90ceaeaeb009
< 1fe735d098d82ad79500eab04c4d25ba8fe25a24
< 2fecc279f5d51e00a203cd400ace24b6053969a4
< 3c96596f7d897e048be4c2c85d941aadd6141ba9
< 3df57a818917737d65e0e1c7cce80e9eb69e5e0b
< 3fc737460caa3c47d9d51751d712cc8784b1dfef
< 4.4.15.9-r0
< 5b0543da6915bac44cb15e7e73f9e1886fe57588
< 5b2b959a40ddd728d5ef4c6b09f118038c5e8af0
< 5ba96c8804d9dd18ad380e9c5cb713201ab3cb89
< 5e5261284190c6fe6985547fbd19d3345df14be1
< 6ab95d9bec50f6be6b5439abed35f99ab3fa5cbc
< 6da64cc3b2ba4439574f914f51e161645375be96
< 07fd0bce678e83d5f81d7a683f1052fe45764d0c
< 13a288d0da6e79b99acb9052bcf31b6650c624b5
< 21eda1c2c42d28370b91c99017dcee7eef9691fd
< 32f512698518214fcc59ea45e0f35b0aedff16cb
< 35e191d74b50c8f5a7b87fa9889869cc3a88255d
< 37b38431d167915675fc8ab512470528147e72de
< 52b6cfde9f581ee6818db0e3f5d80db8c29dfa34
< 64c2b9a59c09e4a04be2238553c3fcfbc58b7949
< 66aba31923f26124e06b2a55b837e4fd47c5ef1d
< 78a6214afcee3a6b65eb5e1ac261aa8e70f36736
< 86a7d2704994c43a4fae11cf38105fc3cb3d4d5b
< 243ed0268fa15567c8a787eeb6055a232102b91a
< 409c9bc50aa447c52d334c839f4aa239f66c5e03
< 426c5d9c1ded024c9306428ce165ae82d6f6d5df
< 00828f9ccb1024fbcd528f41dfdf28fab918dfff
< 2189c875356fc1af21c6da32235bf24f60f53b96
< 2694c36ef6e86de019196698a9de1953645fba97
< 5004dc40980b8dfe04c328abed85fde991833624
< 16136ea0ef224ed22c3dffd629e3e147579f5f38
< 82161a6c30a9ac2502d822e29cfb66beae7eeb4c
< 83416df64f2277d8853fcdd048df7bb154514d03
< 95104ff56e15876c6b481e09c9f0169e34b781f8
< 5118938f103e0022329847b654fcd99c8cb37de7
< 39864227e7c33f9a6ef29890017e48164df54858
< 66149607b1b578bbedc0a90e3c000e8c410c7c8e
< a1b4ecc69bc4ac90a54e3f3c8644ca18f13b010d
< a62fcf03af4c7f9df2393fbe58ae8653166763fa
< a395665715a3f56db9692486d120fb1dc00bcc5d
< ad54449d105365dbbd39ae879306f1037fe238cd
< b0d60e271a6f47d2e0ecd81ad620b5d185acc0b1
< b1cc43ee7f8607c80889570912c5a54b7409b4d1
< b7c2e99987c2c52c6e8010b55b75f3c1c039216a
< b8f86592e900310f0b39d8e5270b26bebd0cfad8
< b9a6a9993e175ff13375462333ce1139095d01e1
< b478a3d5c4fc1341a0a77235d2afbd2b4e4d0a6c
< c68478ad7d0523e42aa789ba24ea5f9018510047
< c21937440af0b0b2ed752f229c3d2523ac178d85
< ceb7d7e1b2f8ab1e61710d0d061f10193a6c44c5
< d0f7dc79905f4795d328a018772871f9f98957fc
< d8f4a2d661f78281db7ee6826651ffc9574a2b31
< d81165f34555c5202d8150ae1d080834dd601d5b
< daf86cd1e369f63ad132d8dc63a7217267030408
< dba2af651a53d5037296a1dc827081a94ef1062c
< e0c1ed02a11b4ed46d82a31b7f95030854865add
< e4db51c0d47ac6e319ba93ce0d5706a33f736c00
< f2db92434b71973a1281dfbaec8837e51e602c77
< f7f483e99a74648843cc87265033442aeb4b7342
< f86761326c97eb5e2c9cefa2b1871252357f00a0
< f1668937772688de3bbd707cee23ef8653756f32
< fecf8b76ef831be0a5a8fddb1c3edf4251e92076
Fixed in 4.4.15.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular web-based administration tool for managing MySQL databases. It provides a user-friendly interface for performing various database operations such as creating tables, executing queries, and managing user permissions. However, a vulnerability has been discovered in phpMyAdmin that allows for cross-site scripting (XSS) attacks.
Vulnerability Detail
The XSS vulnerability in phpMyAdmin is a result of an improper fix for a previous vulnerability (CVE-2016-2559). The issue arises due to a race condition, which can be exploited by an attacker to inject malicious scripts into the application. This can lead to the execution of arbitrary code or the theft of sensitive information. The vulnerability affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18) of phpMyAdmin.
How To Fix
Minimum fixed version
4.4.15.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable phpMyAdmin or restrict access to it. This can be done by blocking access to the phpMyAdmin directory or using access control mechanisms such as IP whitelisting. However, it is strongly recommended to apply the official fix by updating to the latest version as soon as possible.
Conclusion
The XSS vulnerability in phpMyAdmin can be a serious security risk, allowing attackers to execute malicious code or steal sensitive information. It is crucial to update to the latest version of phpMyAdmin to mitigate this vulnerability. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is a web-based administration tool for managing MySQL databases. It provides an intuitive interface for performing various database operations.
An XSS vulnerability allows an attacker to inject malicious scripts into a web application, which can then be executed by unsuspecting users. This can lead to the theft of sensitive information or the execution of arbitrary code.
The XSS vulnerability affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18) of phpMyAdmin.
To fix the vulnerability, it is recommended to update to the latest version of phpMyAdmin. For affected versions, upgrade to version 4.6.5 for 4.6.x, version 4.4.15.9 for 4.4.x, and version 4.0.10.18 for 4.0.x.
If immediate upgrading is not possible, a temporary workaround is to disable phpMyAdmin or restrict access to it. This can be done by blocking access to the phpMyAdmin directory or using access control mechanisms such as IP whitelisting.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
