Fluid Attacks Database

Description

phpMyAdmin Code Injection vulnerability phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	phpmyadmin/phpmyadmin	>=4.0.10.0 <4.0.10.16 \|\| >=4.4.15.0 <4.4.15.7 \|\| >=4.6.0 <4.6.3	4.0.10.16, 4.4.15.7, 4.6.3
debian 11	phpmyadmin	>=0 <4:4.6.3-1	4:4.6.3-1
debian 12	phpmyadmin	>=0 <4:4.6.3-1	4:4.6.3-1
debian 13	phpmyadmin	>=0 <4:4.6.3-1	4:4.6.3-1

Aliases

1. CVE-2016-57342. NVD-2016-57343. OSV-2016-57344. OSV-DEBIAN-2016-57345. GCVE-2016-57346. security.gentoo.org7. SECURITY-TRACKER-CVE-2016-5734

References

1. https://github.com/phpmyadmin/phpmyadmin/commit/1cc7466db3a05e95fe57a6702f41773e6829d54b2. https://github.com/phpmyadmin/phpmyadmin/commit/4bcc606225f15bac0b07780e74f667f6ac283da73. https://web.archive.org/web/20200227223418/http://www.securityfocus.com/bid/913874. https://www.exploit-db.com/exploits/401855. https://www.phpmyadmin.net/security/PMASA-2016-276. https://vulncheck.com/cve/CVE-2016-57347. https://github.com/KosukeShimofuji/CVE-2016-57348. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmyadmin_null_termination_exec.rb