CVE-2016-5733: XSS
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in tablerow.phtml, (2) a crafted mysqld logbin directive that is mishandled in logselector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tblchart.js, or (7) the zoom-search implementation in rowszoom.phtml.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What are the impacts of CVE-2016-5733?
CVE-2016-5733 allows remote attackers to execute arbitrary web scripts or HTML due to multiple cross-site scripting (XSS) vulnerabilities in affected versions of phpMyAdmin.
How do I fix CVE-2016-5733?
To fix CVE-2016-5733, upgrade phpMyAdmin to the latest version that addresses these vulnerabilities, specifically to versions 4.0.10.16, 4.4.15.7, or 4.6.3 and above.
Which versions are affected by CVE-2016-5733?
CVE-2016-5733 affects phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3.
Is CVE-2016-5733 critical?
CVE-2016-5733 is considered a medium severity vulnerability due to its potential for exploitation via XSS attacks.
What measures can be taken to protect against CVE-2016-5733?
In addition to upgrading to a patched version, web administrators should implement security headers and validate all user inputs to mitigate XSS risks.