CVE-2016-9864: SQL Injection

Published Dec 11, 2016

Updated

An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

Affected Software

63 affected components

phpMyAdmin phpMyAdmin=4.6.0

phpMyAdmin phpMyAdmin=4.6.1

phpMyAdmin phpMyAdmin=4.6.2

phpMyAdmin phpMyAdmin=4.6.3

phpMyAdmin phpMyAdmin=4.6.4

phpMyAdmin phpMyAdmin=4.4.0

phpMyAdmin phpMyAdmin=4.4.1

phpMyAdmin phpMyAdmin=4.4.1.1

phpMyAdmin phpMyAdmin=4.4.2

phpMyAdmin phpMyAdmin=4.4.3

phpMyAdmin phpMyAdmin=4.4.4

phpMyAdmin phpMyAdmin=4.4.5

phpMyAdmin phpMyAdmin=4.4.6

phpMyAdmin phpMyAdmin=4.4.6.1

phpMyAdmin phpMyAdmin=4.4.7

phpMyAdmin phpMyAdmin=4.4.8

phpMyAdmin phpMyAdmin=4.4.9

phpMyAdmin phpMyAdmin=4.4.10

phpMyAdmin phpMyAdmin=4.4.11

phpMyAdmin phpMyAdmin=4.4.12

phpMyAdmin phpMyAdmin=4.4.13

phpMyAdmin phpMyAdmin=4.4.13.1

phpMyAdmin phpMyAdmin=4.4.14

phpMyAdmin phpMyAdmin=4.4.14.1

phpMyAdmin phpMyAdmin=4.4.15

phpMyAdmin phpMyAdmin=4.4.15.1

phpMyAdmin phpMyAdmin=4.4.15.2

phpMyAdmin phpMyAdmin=4.4.15.3

phpMyAdmin phpMyAdmin=4.4.15.4

phpMyAdmin phpMyAdmin=4.4.15.5

phpMyAdmin phpMyAdmin=4.4.15.6

phpMyAdmin phpMyAdmin=4.4.15.7

phpMyAdmin phpMyAdmin=4.4.15.8

phpMyAdmin phpMyAdmin=4.0.0

phpMyAdmin phpMyAdmin=4.0.1

phpMyAdmin phpMyAdmin=4.0.2

phpMyAdmin phpMyAdmin=4.0.3

phpMyAdmin phpMyAdmin=4.0.4

phpMyAdmin phpMyAdmin=4.0.4.1

phpMyAdmin phpMyAdmin=4.0.4.2

phpMyAdmin phpMyAdmin=4.0.5

phpMyAdmin phpMyAdmin=4.0.6

phpMyAdmin phpMyAdmin=4.0.7

phpMyAdmin phpMyAdmin=4.0.8

phpMyAdmin phpMyAdmin=4.0.9

phpMyAdmin phpMyAdmin=4.0.10

phpMyAdmin phpMyAdmin=4.0.10.1

phpMyAdmin phpMyAdmin=4.0.10.2

phpMyAdmin phpMyAdmin=4.0.10.3

phpMyAdmin phpMyAdmin=4.0.10.4

phpMyAdmin phpMyAdmin=4.0.10.5

phpMyAdmin phpMyAdmin=4.0.10.6

phpMyAdmin phpMyAdmin=4.0.10.7

phpMyAdmin phpMyAdmin=4.0.10.8

phpMyAdmin phpMyAdmin=4.0.10.9

phpMyAdmin phpMyAdmin=4.0.10.10

phpMyAdmin phpMyAdmin=4.0.10.11

phpMyAdmin phpMyAdmin=4.0.10.12

phpMyAdmin phpMyAdmin=4.0.10.13

phpMyAdmin phpMyAdmin=4.0.10.14

phpMyAdmin phpMyAdmin=4.0.10.15

phpMyAdmin phpMyAdmin=4.0.10.16

phpMyAdmin phpMyAdmin=4.0.10.17

Remediation

Patch Available

https://www.phpmyadmin.net/security/PMASA-2016-69

Event History

Dec 11, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-9864?

CVE-2016-9864 has a medium severity rating due to the potential for unauthorized access to configuration storage database tables.

How do I fix CVE-2016-9864?

To fix CVE-2016-9864, it is recommended to upgrade phpMyAdmin to version 4.6.5 or later.

What versions of phpMyAdmin are affected by CVE-2016-9864?

CVE-2016-9864 affects phpMyAdmin versions 4.0.0 through 4.6.4.

Can CVE-2016-9864 be exploited remotely?

Yes, CVE-2016-9864 can be exploited remotely through crafted SQL statements.

What are the potential impacts of CVE-2016-9864?

The impacts of CVE-2016-9864 include unauthorized read and write access to the configuration storage database.