CVE-2016-6609
HighSummary
An issue was discovered in phpMyAdmin that allows arbitrary PHP commands to be executed through a specially crafted database name in the array export feature. This affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).
Risk Assessment
Exploitation of this vulnerability could lead to remote code execution, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update phpMyAdmin to the latest version to mitigate this vulnerability and conduct a security audit of the system.
Other vulnerabilities in phpMyAdmin
See all- CVE-2017-1000018High
phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a DoS attack in the replication status by using a specially crafted table name.
- CVE-2017-1000017High
phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a weakness that allows a user with appropriate permissions to connect to an arbitrary MySQL server.
- CVE-2017-1000014High
phpMyAdmin versions 4.0, 4.4, and 4.6 are vulnerable to a DoS weakness in the table editing functionality.
- CVE-2016-6621High
The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
- CVE-2016-9864High
An issue was discovered in phpMyAdmin that allows SQL injection via a crafted username or table name in the tracking functionality. The executed statements run with the privileges of the control user, granting access to configuration storage database tables and, if the control user has the necessary privileges, to some MySQL database tables.
- CVE-2016-9863High
An issue was discovered in phpMyAdmin that allows for a Denial of Service (DoS) attack through a very large request to the table partitioning function. All 4.6.x versions prior to 4.6.5 are affected.
- CVE-2016-9862High
An issue was discovered in phpMyAdmin that allows for BBCode injection on the login page via a crafted login request. All 4.6.x versions (prior to 4.6.5) are affected.
- CVE-2016-9861High
An issue was discovered in phpMyAdmin related to the limitation in URL matching, allowing for the bypass of URL white-list protection. This affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18).
- CVE-2016-6633High
An issue was discovered in phpMyAdmin that can lead to remote code execution in certain PHP installations running with the dbase extension. This affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).
- CVE-2016-6631High
An issue was discovered in phpMyAdmin that allows for remote code execution when the application is run as CGI. A user can pass a query string that is executed as a command-line argument by the file generator_plugin.sh.
Original NVD description (English source)
An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.