Main Vulnerability Database Vulnerabilities #VU33584

Code Injection in phpMyAdmin - CVE-2016-9862

Published: December 11, 2016 / Updated: August 4, 2020

Vulnerability identifier: #VU33584

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-9862

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to manipulate data.

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.

Affected software

phpMyAdmin
phpmyadmin (Alpine package)

How to mitigate CVE-2016-9862

Install update from vendor's website.

phpmyadmin (Alpine package) - update to 4.6.5.2-r0

External References

http://www.securityfocus.com/bid/94528
https://security.gentoo.org/glsa/201701-32
https://www.phpmyadmin.net/security/PMASA-2016-67

Related Security Bulletins