CVE-2016-1927
HighSummary
The suggestPassword function in phpMyAdmin before version 4.0.10.13, 4.4.15.3, and 4.5.4 relies on the Math.random JavaScript function, making it easier for remote attackers to guess passwords via a brute-force approach.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to user accounts, posing a serious threat to data security within the organization.
Recommendation
It is recommended to update phpMyAdmin to the latest version to eliminate this vulnerability and consider implementing stronger password generation methods.
Other vulnerabilities in phpMyAdmin
See all- CVE-2017-1000018High
phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a DoS attack in the replication status by using a specially crafted table name.
- CVE-2017-1000017High
phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a weakness that allows a user with appropriate permissions to connect to an arbitrary MySQL server.
- CVE-2017-1000014High
phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a DoS weakness in the table editing functionality.
- CVE-2016-6621High
The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
- CVE-2016-9864High
An issue was discovered in phpMyAdmin that allows SQL injection via a crafted username or table name in the tracking functionality. The executed statements run with the privileges of the control user, granting access to configuration storage database tables and, if the control user has the necessary privileges, to some MySQL database tables.
- CVE-2016-9863High
An issue was discovered in phpMyAdmin that allows for a Denial of Service (DoS) attack through a very large request to the table partitioning function. All 4.6.x versions prior to 4.6.5 are affected.
- CVE-2016-9862High
An issue was discovered in phpMyAdmin that allows for BBCode injection on the login page via a crafted login request. All 4.6.x versions (prior to 4.6.5) are affected.
- CVE-2016-9861High
An issue was discovered in phpMyAdmin related to the limitation in URL matching, allowing for the bypass of URL white-list protection. This affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18).
- CVE-2016-6633High
An issue was discovered in phpMyAdmin that can lead to remote code execution in certain PHP installations running with the dbase extension. This affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).
- CVE-2016-6631High
An issue was discovered in phpMyAdmin that allows for remote code execution when the application is run as CGI. A user can pass a query string that is executed as a command-line argument by the file generator_plugin.sh.
Original NVD description (English source)
The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.