Server-Side Request Forgery Vulnerability in phpMyAdmin: CVE-2016-6621
Summary
CVE-2016-6621: The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors. Affects phpmyadmin across 37 version ranges.
< 0fc00c0ab895cf83883ce43435f9563019e1b0f5
< 1c1753bb6666381fa2cd2cd1f160286935244a35
< 1f1e63cd5956eca847891b28b24e90ceaeaeb009
< 1fe735d098d82ad79500eab04c4d25ba8fe25a24
< 3fc737460caa3c47d9d51751d712cc8784b1dfef
< 4:4.6.6-1
< 5b0543da6915bac44cb15e7e73f9e1886fe57588
< 6ab95d9bec50f6be6b5439abed35f99ab3fa5cbc
< 07fd0bce678e83d5f81d7a683f1052fe45764d0c
< 32f512698518214fcc59ea45e0f35b0aedff16cb
< 35e191d74b50c8f5a7b87fa9889869cc3a88255d
< 37b38431d167915675fc8ab512470528147e72de
< 73fd0dc2a8f5471c717a887aae22bde97bc5498f
< 78a6214afcee3a6b65eb5e1ac261aa8e70f36736
< 86a7d2704994c43a4fae11cf38105fc3cb3d4d5b
< 243ed0268fa15567c8a787eeb6055a232102b91a
< 409c9bc50aa447c52d334c839f4aa239f66c5e03
< 426c5d9c1ded024c9306428ce165ae82d6f6d5df
< 95104ff56e15876c6b481e09c9f0169e34b781f8
< 253894e2995ae4175f4429bf5cdaedfb6a722988
< 8783113cec408ad9a81f17e3a97db6c4732e6164
< 39864227e7c33f9a6ef29890017e48164df54858
< 0748384685693e3ecf97b021ccab075e295d4d65
< a1b4ecc69bc4ac90a54e3f3c8644ca18f13b010d
< a6ecc52b3d1245a30d270d871992f2fedcf84be6
< a62fcf03af4c7f9df2393fbe58ae8653166763fa
< b0d60e271a6f47d2e0ecd81ad620b5d185acc0b1
< b7c2e99987c2c52c6e8010b55b75f3c1c039216a
< b9a6a9993e175ff13375462333ce1139095d01e1
< b478a3d5c4fc1341a0a77235d2afbd2b4e4d0a6c
< c21937440af0b0b2ed752f229c3d2523ac178d85
< d8f4a2d661f78281db7ee6826651ffc9574a2b31
< daf86cd1e369f63ad132d8dc63a7217267030408
< dba2af651a53d5037296a1dc827081a94ef1062c
< e4db51c0d47ac6e319ba93ce0d5706a33f736c00
< f7f483e99a74648843cc87265033442aeb4b7342
< fecf8b76ef831be0a5a8fddb1c3edf4251e92076
Fixed in 4:4.6.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely used open-source tool for managing MySQL databases through a web interface. It allows users to perform various database operations such as creating, modifying, and deleting databases and tables, executing SQL queries, and managing user permissions. The tool is popular among developers and database administrators for its ease of use and extensive features. However, certain versions of phpMyAdmin are vulnerable to a server-side request forgery (SSRF) attack, which can lead to unauthorized access to internal resources.
Vulnerability Detail
CVE-2016-6621 is a vulnerability found in phpMyAdmin versions prior to 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6. This vulnerability allows remote attackers to conduct SSRF attacks via unspecified vectors. SSRF vulnerabilities can enable attackers to send crafted requests from the server to internal or external resources, potentially exposing sensitive information or allowing further exploitation of the server.
How To Fix
Minimum fixed version
4:4.6.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider restricting access to phpMyAdmin by implementing firewall rules or using a VPN to limit exposure. Additionally, review and restrict the permissions of the web server user to minimize potential damage from an SSRF attack.
Conclusion
CVE-2016-6621 is a significant vulnerability in phpMyAdmin that can lead to serious security risks if not addressed. It is crucial for users of affected versions to upgrade to the latest version to mitigate the risk of SSRF attacks. Additionally, implementing workarounds can provide temporary relief until an upgrade can be performed.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2016-6621 is a vulnerability in phpMyAdmin that allows remote attackers to perform server-side request forgery (SSRF) attacks.
The affected versions include phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6.
The vulnerability can lead to unauthorized access to internal resources, potentially exposing sensitive data or allowing further exploitation of the server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2016-6621 is 8.6, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
