phpMyAdmin Full Path Disclosure Vulnerability in phpmyadmin/phpmyadmin
Summary
CVE-2016-5730: phpMyAdmin full path disclosure vulnerability. Affects phpmyadmin/phpmyadmin across 3 version ranges.
>= 4.0, < 4.0.10.16
>= 4.4, < 4.4.15.7
>= 4.6, < 4.6.3
Fixed in 4.0.10.16, 4.4.15.7 or 4.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2016-5730 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
phpMyAdmin is a popular open-source tool written in PHP that is used for managing MySQL and MariaDB databases. It provides a web-based interface for performing various database administration tasks such as creating databases, tables, and executing SQL queries. The vulnerability identified in phpMyAdmin allows remote attackers to obtain sensitive information by exploiting certain vectors within the application.
Vulnerability Detail
The vulnerability in phpMyAdmin arises from multiple vectors, including passing an array value to FormDisplay.php, providing incorrect data to validate.php, supplying unexpected data to Validator.php, missing the config directory during setup, or using an incorrect OpenID identifier data type. These vectors can be exploited by attackers to reveal the full path of the application in error messages. This information disclosure can potentially aid attackers in further exploiting the system or launching targeted attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0, < 4.0.10.164.0.10.16composer require phpmyadmin/phpmyadmin:4.0.10.16 -
>= 4.4, < 4.4.15.74.4.15.7composer require phpmyadmin/phpmyadmin:4.4.15.7 -
>= 4.6, < 4.6.34.6.3composer require phpmyadmin/phpmyadmin:4.6.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to modify the affected files to prevent the disclosure of sensitive information. However, this workaround is not a permanent solution and should be followed by upgrading to the latest version as soon as possible. It is advised to consult the official documentation or the vendor's advisory for specific instructions on applying the workaround.
Conclusion
The phpMyAdmin Full Path Disclosure Vulnerability in phpmyadmin/phpmyadmin can potentially expose sensitive information to remote attackers. It is crucial to upgrade to the latest version of phpMyAdmin (4.0.10.16, 4.4.15.7, or 4.6.3) to mitigate this vulnerability. If immediate upgrading is not possible, applying the temporary workaround and seeking further guidance from the official documentation or the vendor's advisory is recommended. For additional support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool used for managing MySQL and MariaDB databases through a web-based interface.
The vulnerability allows remote attackers to obtain sensitive information, potentially aiding them in further exploiting the system or launching targeted attacks.
To fix this vulnerability, it is recommended to upgrade to the latest version of phpMyAdmin (4.0.10.16, 4.4.15.7, or 4.6.3).
A temporary workaround is to modify the affected files to prevent the disclosure of sensitive information. However, upgrading to the latest version is the recommended solution.
You can find more information about this vulnerability in the official documentation or the vendor's advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
