CVE-2016-6611: SQL Injection

Published Dec 11, 2016

Updated

An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

Affected Software

64 affected components

phpMyAdmin phpMyAdmin=4.0.0

phpMyAdmin phpMyAdmin=4.0.0-rc2

phpMyAdmin phpMyAdmin=4.0.0-rc3

phpMyAdmin phpMyAdmin=4.0.1

phpMyAdmin phpMyAdmin=4.0.2

phpMyAdmin phpMyAdmin=4.0.3

phpMyAdmin phpMyAdmin=4.0.4

phpMyAdmin phpMyAdmin=4.0.4.1

phpMyAdmin phpMyAdmin=4.0.4.2

phpMyAdmin phpMyAdmin=4.0.5

phpMyAdmin phpMyAdmin=4.0.6

phpMyAdmin phpMyAdmin=4.0.7

phpMyAdmin phpMyAdmin=4.0.8

phpMyAdmin phpMyAdmin=4.0.9

phpMyAdmin phpMyAdmin=4.0.10

phpMyAdmin phpMyAdmin=4.0.10.1

phpMyAdmin phpMyAdmin=4.0.10.2

phpMyAdmin phpMyAdmin=4.0.10.3

phpMyAdmin phpMyAdmin=4.0.10.4

phpMyAdmin phpMyAdmin=4.0.10.5

phpMyAdmin phpMyAdmin=4.0.10.6

phpMyAdmin phpMyAdmin=4.0.10.7

phpMyAdmin phpMyAdmin=4.0.10.8

phpMyAdmin phpMyAdmin=4.0.10.9

phpMyAdmin phpMyAdmin=4.0.10.10

phpMyAdmin phpMyAdmin=4.0.10.11

phpMyAdmin phpMyAdmin=4.0.10.12

phpMyAdmin phpMyAdmin=4.0.10.13

phpMyAdmin phpMyAdmin=4.0.10.14

phpMyAdmin phpMyAdmin=4.0.10.15

phpMyAdmin phpMyAdmin=4.0.10.16

phpMyAdmin phpMyAdmin=4.4.0

phpMyAdmin phpMyAdmin=4.4.1

phpMyAdmin phpMyAdmin=4.4.1.1

phpMyAdmin phpMyAdmin=4.4.2

phpMyAdmin phpMyAdmin=4.4.3

phpMyAdmin phpMyAdmin=4.4.4

phpMyAdmin phpMyAdmin=4.4.5

phpMyAdmin phpMyAdmin=4.4.6

phpMyAdmin phpMyAdmin=4.4.6.1

phpMyAdmin phpMyAdmin=4.4.7

phpMyAdmin phpMyAdmin=4.4.8

phpMyAdmin phpMyAdmin=4.4.9

phpMyAdmin phpMyAdmin=4.4.10

phpMyAdmin phpMyAdmin=4.4.11

phpMyAdmin phpMyAdmin=4.4.12

phpMyAdmin phpMyAdmin=4.4.13

phpMyAdmin phpMyAdmin=4.4.13.1

phpMyAdmin phpMyAdmin=4.4.14.1

phpMyAdmin phpMyAdmin=4.4.15

phpMyAdmin phpMyAdmin=4.4.15.1

phpMyAdmin phpMyAdmin=4.4.15.2

phpMyAdmin phpMyAdmin=4.4.15.3

phpMyAdmin phpMyAdmin=4.4.15.4

phpMyAdmin phpMyAdmin=4.4.15.5

phpMyAdmin phpMyAdmin=4.4.15.6

phpMyAdmin phpMyAdmin=4.4.15.7

phpMyAdmin phpMyAdmin=4.6.0

phpMyAdmin phpMyAdmin=4.6.0-alpha1

phpMyAdmin phpMyAdmin=4.6.0-rc1

phpMyAdmin phpMyAdmin=4.6.0-rc2

phpMyAdmin phpMyAdmin=4.6.1

phpMyAdmin phpMyAdmin=4.6.2

phpMyAdmin phpMyAdmin=4.6.3

Remediation

Patch Available

https://www.phpmyadmin.net/security/PMASA-2016-34

Event History

Dec 11, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-6611?

CVE-2016-6611 is considered a medium severity SQL injection vulnerability in phpMyAdmin.

How do I fix CVE-2016-6611?

To fix CVE-2016-6611, upgrade to phpMyAdmin version 4.6.4 or later, 4.4.15.8 or later, or 4.0.10.17 or later.

What versions of phpMyAdmin are affected by CVE-2016-6611?

All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected.

Can CVE-2016-6611 be exploited remotely?

Yes, CVE-2016-6611 can be exploited remotely through the export functionality of phpMyAdmin.

What is the nature of the attack in CVE-2016-6611?

CVE-2016-6611 involves an SQL injection attack that can be triggered by specially crafted database or table names.