CVE-2016-5734
CriticalSummary
phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 do not properly choose delimiters, which may allow remote attackers to execute arbitrary PHP code via a crafted string.
Risk Assessment
Exploitation of this vulnerability could lead to remote code execution, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update phpMyAdmin to the latest version to mitigate this vulnerability and to implement additional security measures, such as restricting access to the application.
Original NVD description (English source)
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.