CVE-2016-9849
CriticalSummary
An issue was discovered in phpMyAdmin that allows bypassing the AllowRoot restriction and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Risk Assessment
The organization may be exposed to unauthorized access to the system, potentially leading to serious data security breaches.
Recommendation
It is recommended to update phpMyAdmin to the latest version to mitigate this vulnerability and implement additional security measures.
Original NVD description (English source)
An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.