SQL injection in phpMyAdmin - CVE-2016-9864
Published: December 11, 2016 / Updated: August 4, 2020
Vulnerability identifier: #VU33583
CSH Severity: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2016-9864
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
phpMyAdmin
phpMyAdmin
Software vendor:
phpMyAdmin
phpMyAdmin
Description
The vulnerability allows a remote authenticated user to execute arbitrary code.
An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Remediation
Install update from vendor's website.