An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Advisories
Source ID Title
Debian DLA Debian DLA DLA-757-1 phpmyadmin security update
Debian DLA Debian DLA DLA-1821-1 phpmyadmin security update
EUVD EUVD EUVD-2016-10656 An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-06T02:59:03.561Z

Reserved: 2016-12-06T00:00:00

Link: CVE-2016-9864

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2016-12-11T03:00:06.057

Modified: 2025-04-12T10:46:40.837

Link: CVE-2016-9864

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses