#VU33613 Path traversal in phpMyAdmin - CVE-2016-6614

Vulnerability identifier: #VU33613

Vulnerability risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-6614

CWE-ID: CWE-22

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
phpMyAdmin
Web applications / Remote management & hosting panels

Vendor: phpMyAdmin

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

Mitigation
Install update from vendor's website.

Vulnerable software versions

phpMyAdmin: 4.0.0 - 4.0.10.16, 4.4.0 - 4.4.15.7, 4.6.0 - 4.6.3

---

External links
https://www.securityfocus.com/bid/94366
https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html
https://security.gentoo.org/glsa/201701-32
https://www.phpmyadmin.net/security/PMASA-2016-37

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.