Denial of Service Vulnerability in phpMyAdmin
Summary
CVE-2016-9859: An issue was discovered in phpMyAdmin. Affects phpmyadmin across 64 version ranges.
< 1c1753bb6666381fa2cd2cd1f160286935244a35
< 1f1e63cd5956eca847891b28b24e90ceaeaeb009
< 1fe735d098d82ad79500eab04c4d25ba8fe25a24
< 2fecc279f5d51e00a203cd400ace24b6053969a4
< 3c96596f7d897e048be4c2c85d941aadd6141ba9
< 3df57a818917737d65e0e1c7cce80e9eb69e5e0b
< 3fc737460caa3c47d9d51751d712cc8784b1dfef
< 4.4.15.9-r0
< 5b0543da6915bac44cb15e7e73f9e1886fe57588
< 5b2b959a40ddd728d5ef4c6b09f118038c5e8af0
< 5ba96c8804d9dd18ad380e9c5cb713201ab3cb89
< 5e5261284190c6fe6985547fbd19d3345df14be1
< 6ab95d9bec50f6be6b5439abed35f99ab3fa5cbc
< 6da64cc3b2ba4439574f914f51e161645375be96
< 07fd0bce678e83d5f81d7a683f1052fe45764d0c
< 13a288d0da6e79b99acb9052bcf31b6650c624b5
< 21eda1c2c42d28370b91c99017dcee7eef9691fd
< 32f512698518214fcc59ea45e0f35b0aedff16cb
< 35e191d74b50c8f5a7b87fa9889869cc3a88255d
< 37b38431d167915675fc8ab512470528147e72de
< 52b6cfde9f581ee6818db0e3f5d80db8c29dfa34
< 64c2b9a59c09e4a04be2238553c3fcfbc58b7949
< 66aba31923f26124e06b2a55b837e4fd47c5ef1d
< 78a6214afcee3a6b65eb5e1ac261aa8e70f36736
< 86a7d2704994c43a4fae11cf38105fc3cb3d4d5b
< 243ed0268fa15567c8a787eeb6055a232102b91a
< 409c9bc50aa447c52d334c839f4aa239f66c5e03
< 426c5d9c1ded024c9306428ce165ae82d6f6d5df
< 00828f9ccb1024fbcd528f41dfdf28fab918dfff
< 2189c875356fc1af21c6da32235bf24f60f53b96
< 2694c36ef6e86de019196698a9de1953645fba97
< 5004dc40980b8dfe04c328abed85fde991833624
< 16136ea0ef224ed22c3dffd629e3e147579f5f38
< 82161a6c30a9ac2502d822e29cfb66beae7eeb4c
< 83416df64f2277d8853fcdd048df7bb154514d03
< 95104ff56e15876c6b481e09c9f0169e34b781f8
< 5118938f103e0022329847b654fcd99c8cb37de7
< 39864227e7c33f9a6ef29890017e48164df54858
< 66149607b1b578bbedc0a90e3c000e8c410c7c8e
< a1b4ecc69bc4ac90a54e3f3c8644ca18f13b010d
< a62fcf03af4c7f9df2393fbe58ae8653166763fa
< a395665715a3f56db9692486d120fb1dc00bcc5d
< ad54449d105365dbbd39ae879306f1037fe238cd
< b0d60e271a6f47d2e0ecd81ad620b5d185acc0b1
< b1cc43ee7f8607c80889570912c5a54b7409b4d1
< b7c2e99987c2c52c6e8010b55b75f3c1c039216a
< b8f86592e900310f0b39d8e5270b26bebd0cfad8
< b9a6a9993e175ff13375462333ce1139095d01e1
< b478a3d5c4fc1341a0a77235d2afbd2b4e4d0a6c
< c68478ad7d0523e42aa789ba24ea5f9018510047
< c21937440af0b0b2ed752f229c3d2523ac178d85
< ceb7d7e1b2f8ab1e61710d0d061f10193a6c44c5
< d0f7dc79905f4795d328a018772871f9f98957fc
< d8f4a2d661f78281db7ee6826651ffc9574a2b31
< d81165f34555c5202d8150ae1d080834dd601d5b
< daf86cd1e369f63ad132d8dc63a7217267030408
< dba2af651a53d5037296a1dc827081a94ef1062c
< e0c1ed02a11b4ed46d82a31b7f95030854865add
< e4db51c0d47ac6e319ba93ce0d5706a33f736c00
< f2db92434b71973a1281dfbaec8837e51e602c77
< f7f483e99a74648843cc87265033442aeb4b7342
< f86761326c97eb5e2c9cefa2b1871252357f00a0
< f1668937772688de3bbd707cee23ef8653756f32
< fecf8b76ef831be0a5a8fddb1c3edf4251e92076
Fixed in 4.4.15.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks. The vulnerability identified as CVE-2016-9859 affects multiple versions of phpMyAdmin, including 4.6.x, 4.4.x, and 4.0.x. This vulnerability can be exploited by sending a crafted request parameter value, leading to a denial of service attack in the import feature.
Vulnerability Detail
The vulnerability (CVE-2016-9859) in phpMyAdmin allows an attacker to initiate a denial of service attack by exploiting a flaw in the import feature. By sending a specially crafted request parameter value, an attacker can cause the import feature to crash, resulting in a denial of service condition. This vulnerability affects phpMyAdmin versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18). The impact of this vulnerability is limited to the availability of the import feature and does not allow for remote code execution or unauthorized access to the database.
How To Fix
Minimum fixed version
4.4.15.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended course of action is to apply the available updates to phpMyAdmin as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in phpMyAdmin (CVE-2016-9859) allows an attacker to initiate a denial of service attack by exploiting a flaw in the import feature. To mitigate this vulnerability, it is crucial to update phpMyAdmin to the recommended versions. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is an open-source tool used for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks.
The vulnerability allows an attacker to initiate a denial of service attack by exploiting a flaw in the import feature of phpMyAdmin. However, it does not allow for remote code execution or unauthorized access to the database.
The vulnerability affects phpMyAdmin versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18).
To fix this vulnerability, it is recommended to update phpMyAdmin to version 4.6.5 if using a 4.6.x version, or version 4.4.15.9 if using a 4.4.x version. For version 4.0.x, the recommended update is to version 4.0.10.18.
There is no specific workaround mentioned for this vulnerability. The recommended course of action is to apply the available updates to phpMyAdmin.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
