CVE-2016-9866
CriticalSummary
An issue was discovered in phpMyAdmin related to improper stripping of the CSRF token from the return URL of the preference import action when the arg_separator is different from its default '&' value. This affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18).
Risk Assessment
Organizations may be exposed to CSRF attacks, potentially leading to unauthorized actions within the phpMyAdmin system. Exploiting this vulnerability could result in data loss or unauthorized access to the system.
Recommendation
It is recommended to update phpMyAdmin to the latest version to mitigate this vulnerability. Additionally, consider implementing extra security measures such as CSRF token validation.
Original NVD description (English source)
An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.