phpmyadmin/composer · Security
phpMyAdmin PHP code injection
- GHSA ID
- GHSA-wpww-hx7x-xfjh
- CVE ID
- CVE-2016-6609
- Severity
- high
- Published
- Updated
- CVSS
- 8.8 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 8.8 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
CWEs
- CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-6609 ↗
- https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html ↗
- https://security.gentoo.org/glsa/201701-32 ↗
- https://www.phpmyadmin.net/security/PMASA-2016-32 ↗
- http://www.securityfocus.com/bid/94112 ↗
- https://github.com/advisories/GHSA-wpww-hx7x-xfjh ↗