Critical Vulnerability in phpMyAdmin: Arbitrary Server Bypass
Summary
UBUNTU-CVE-2016-6629: An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive. Affects phpmyadmin versions 4:4.0.10-1 – 4:4.0.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely-used open-source tool for managing MySQL databases through a web interface. It provides a user-friendly way to perform database operations such as creating, modifying, and deleting databases and tables. However, certain configurations can expose it to security vulnerabilities, such as the one identified in CVE-2016-6629, which allows attackers to bypass server restrictions.
Vulnerability Detail
The vulnerability arises from the $cfg['ArbitraryServerRegexp'] configuration directive in phpMyAdmin. An attacker can exploit this by reusing specific cookie values to bypass the server restrictions defined by ArbitraryServerRegexp. This could lead to unauthorized access to sensitive data, as attackers may gain the ability to connect to unintended servers. Affected versions include all 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the use of the $cfg['ArbitraryServerRegexp'] directive in their configuration file until an upgrade can be performed. This can be done by commenting out the line in the configuration file: // $cfg['ArbitraryServerRegexp'] = 'your-regex-here';
Conclusion
In summary, CVE-2016-6629 is a critical vulnerability in phpMyAdmin that allows attackers to bypass server restrictions. It is crucial to update to the latest patched versions to mitigate the risks associated with this vulnerability. Temporary workarounds can be employed until an update is feasible.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2016-6629 is a security vulnerability in phpMyAdmin that allows attackers to bypass server restrictions using cookie values.
You can check your phpMyAdmin version against the affected versions listed in the vulnerability details. Additionally, you can use Vulert's playground to monitor for vulnerabilities.
If an immediate update is not possible, consider disabling the $cfg['ArbitraryServerRegexp'] directive in your configuration as a temporary workaround.
Failing to address this vulnerability could lead to unauthorized access to your databases, potentially exposing sensitive data to attackers.
You can visit Vulert.com, which provides real-time monitoring and alerts for open-source vulnerabilities using a simple manifest file.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
