SQL Injection in phpMyAdmin
Summary
CVE-2016-9864: An issue was discovered in phpMyAdmin. Affects phpmyadmin across 64 version ranges.
< 1c1753bb6666381fa2cd2cd1f160286935244a35
< 1f1e63cd5956eca847891b28b24e90ceaeaeb009
< 1fe735d098d82ad79500eab04c4d25ba8fe25a24
< 2fecc279f5d51e00a203cd400ace24b6053969a4
< 3c96596f7d897e048be4c2c85d941aadd6141ba9
< 3df57a818917737d65e0e1c7cce80e9eb69e5e0b
< 3fc737460caa3c47d9d51751d712cc8784b1dfef
< 4.4.15.9-r0
< 5b0543da6915bac44cb15e7e73f9e1886fe57588
< 5b2b959a40ddd728d5ef4c6b09f118038c5e8af0
< 5ba96c8804d9dd18ad380e9c5cb713201ab3cb89
< 5e5261284190c6fe6985547fbd19d3345df14be1
< 6ab95d9bec50f6be6b5439abed35f99ab3fa5cbc
< 6da64cc3b2ba4439574f914f51e161645375be96
< 07fd0bce678e83d5f81d7a683f1052fe45764d0c
< 13a288d0da6e79b99acb9052bcf31b6650c624b5
< 21eda1c2c42d28370b91c99017dcee7eef9691fd
< 32f512698518214fcc59ea45e0f35b0aedff16cb
< 35e191d74b50c8f5a7b87fa9889869cc3a88255d
< 37b38431d167915675fc8ab512470528147e72de
< 52b6cfde9f581ee6818db0e3f5d80db8c29dfa34
< 64c2b9a59c09e4a04be2238553c3fcfbc58b7949
< 66aba31923f26124e06b2a55b837e4fd47c5ef1d
< 78a6214afcee3a6b65eb5e1ac261aa8e70f36736
< 86a7d2704994c43a4fae11cf38105fc3cb3d4d5b
< 243ed0268fa15567c8a787eeb6055a232102b91a
< 409c9bc50aa447c52d334c839f4aa239f66c5e03
< 426c5d9c1ded024c9306428ce165ae82d6f6d5df
< 00828f9ccb1024fbcd528f41dfdf28fab918dfff
< 2189c875356fc1af21c6da32235bf24f60f53b96
< 2694c36ef6e86de019196698a9de1953645fba97
< 5004dc40980b8dfe04c328abed85fde991833624
< 16136ea0ef224ed22c3dffd629e3e147579f5f38
< 82161a6c30a9ac2502d822e29cfb66beae7eeb4c
< 83416df64f2277d8853fcdd048df7bb154514d03
< 95104ff56e15876c6b481e09c9f0169e34b781f8
< 5118938f103e0022329847b654fcd99c8cb37de7
< 39864227e7c33f9a6ef29890017e48164df54858
< 66149607b1b578bbedc0a90e3c000e8c410c7c8e
< a1b4ecc69bc4ac90a54e3f3c8644ca18f13b010d
< a62fcf03af4c7f9df2393fbe58ae8653166763fa
< a395665715a3f56db9692486d120fb1dc00bcc5d
< ad54449d105365dbbd39ae879306f1037fe238cd
< b0d60e271a6f47d2e0ecd81ad620b5d185acc0b1
< b1cc43ee7f8607c80889570912c5a54b7409b4d1
< b7c2e99987c2c52c6e8010b55b75f3c1c039216a
< b8f86592e900310f0b39d8e5270b26bebd0cfad8
< b9a6a9993e175ff13375462333ce1139095d01e1
< b478a3d5c4fc1341a0a77235d2afbd2b4e4d0a6c
< c68478ad7d0523e42aa789ba24ea5f9018510047
< c21937440af0b0b2ed752f229c3d2523ac178d85
< ceb7d7e1b2f8ab1e61710d0d061f10193a6c44c5
< d0f7dc79905f4795d328a018772871f9f98957fc
< d8f4a2d661f78281db7ee6826651ffc9574a2b31
< d81165f34555c5202d8150ae1d080834dd601d5b
< daf86cd1e369f63ad132d8dc63a7217267030408
< dba2af651a53d5037296a1dc827081a94ef1062c
< e0c1ed02a11b4ed46d82a31b7f95030854865add
< e4db51c0d47ac6e319ba93ce0d5706a33f736c00
< f2db92434b71973a1281dfbaec8837e51e602c77
< f7f483e99a74648843cc87265033442aeb4b7342
< f86761326c97eb5e2c9cefa2b1871252357f00a0
< f1668937772688de3bbd707cee23ef8653756f32
< fecf8b76ef831be0a5a8fddb1c3edf4251e92076
Fixed in 4.4.15.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface for users to interact with their databases, allowing them to perform various tasks such as creating tables, executing queries, and managing user privileges. However, a vulnerability has been discovered in phpMyAdmin that allows an attacker to inject malicious SQL statements through a crafted username or table name. This vulnerability affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18) of phpMyAdmin.
Vulnerability Detail
The vulnerability in phpMyAdmin allows an attacker to execute arbitrary SQL statements with the privileges of the control user. By exploiting this vulnerability, an attacker can gain read and write access to the tables of the configuration storage database. If the control user has the necessary privileges, the attacker can also gain read access to some tables of the MySQL database. This can lead to unauthorized access, data manipulation, and potentially further compromise of the affected system.
How To Fix
Minimum fixed version
4.4.15.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to follow secure coding practices and input validation techniques to prevent SQL injection attacks. Additionally, restricting access to phpMyAdmin and ensuring that only trusted users have control user privileges can help mitigate the impact of this vulnerability.
Conclusion
The SQL injection vulnerability in phpMyAdmin can lead to unauthorized access and data manipulation. It is important to upgrade to the latest version of phpMyAdmin that includes patches for this vulnerability. Regularly updating phpMyAdmin and following secure coding practices can help mitigate the risk of SQL injection attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases. It provides a web-based interface for users to interact with their databases.
Versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18) of phpMyAdmin are affected by this vulnerability.
By exploiting this vulnerability, an attacker can execute arbitrary SQL statements with the privileges of the control user. This can lead to unauthorized access, data manipulation, and potentially further compromise of the affected system.
To fix this vulnerability, upgrade to the latest version of phpMyAdmin (4.6.5, 4.4.15.9, or 4.0.10.18) that includes patches for this SQL injection vulnerability.
There are no specific workarounds mentioned for this vulnerability. However, following secure coding practices and input validation techniques can help prevent SQL injection attacks.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
