CVE-2016-9862: Code Injection
Published Dec 11, 2016
·Updated
An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.
Affected Software
5 affected components
phpMyAdmin phpMyAdmin=4.6.0
phpMyAdmin phpMyAdmin=4.6.1
phpMyAdmin phpMyAdmin=4.6.2
phpMyAdmin phpMyAdmin=4.6.3
phpMyAdmin phpMyAdmin=4.6.4
Remediation
Patch Available
Event History
Dec 11, 2016
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-9862?
CVE-2016-9862 is considered a moderate severity vulnerability due to the potential for script injection via crafted login requests.
2
How do I fix CVE-2016-9862?
To fix CVE-2016-9862, upgrade phpMyAdmin to version 4.6.5 or later.
3
What versions of phpMyAdmin are affected by CVE-2016-9862?
CVE-2016-9862 affects all phpMyAdmin versions from 4.6.0 to 4.6.4.
4
Can CVE-2016-9862 be exploited remotely?
Yes, CVE-2016-9862 can be exploited remotely as it involves a vulnerability in the login page.
5
Is CVE-2016-9862 still a concern today?
While the immediate risk is mitigated by upgrading, it is important to keep software updated to avoid similar vulnerabilities.