CVE-2016-6620

Critical

Published: 11/12/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An issue was discovered in phpMyAdmin related to the PHP unserialize() function, which does not verify the validity of data before deserialization. This can lead to code execution due to the interaction with object instantiation and autoloading.

Risk Assessment

Exploitation of this vulnerability may lead to remote code execution, posing a serious threat to the security of the system and the organization's data.

Recommendation

It is recommended to update phpMyAdmin to version 4.6.4 or newer, 4.4.15.8 or newer, and 4.0.10.17 or newer to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that it's valid serialized data. The unserialization can result in code execution because of the interaction with object instantiation and autoloading. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.