PT-2016-6983 · Phpmyadmin+2 · Phpmyadmin+2

E3Amn2L · Publicado 2014-05-05 · Atualizado 2024-06-15 · CVE-2016-6607

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.x through 4.0.10.16 phpMyAdmin versions 4.4.x through 4.4.15.7 phpMyAdmin versions 4.6.x through 4.6.3

Description XSS issues were discovered in phpMyAdmin, affecting various components such as Zoom search, GIS editor, Relation view, and certain transformations. These issues can be triggered by specially crafted content, allowing an XSS attack. The affected components also include XML export, MediaWiki export, Designer, and the Replication feature, among others.

Recommendations For phpMyAdmin versions 4.0.x through 4.0.10.16, update to version 4.0.10.17 or later. For phpMyAdmin versions 4.4.x through 4.4.15.7, update to version 4.4.15.8 or later. For phpMyAdmin versions 4.6.x through 4.6.3, update to version 4.6.4 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2014-1591

ALT-PU-2016-2421

CVE-2016-6607

DLA-1821-1

DLA-626-1

MGASA-2016-0291

OPENSUSE-SU-2016_2168-1

OPENSUSE-SU-2024:10054-1

Produtos afetados

Alt Linux

Suse

Phpmyadmin

Referências · 282

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmyadmin_null_termination_exec.rb · Exploit
• 🔥 https://github.com/coffeehb/Some-PoC-oR-ExP/blob/master/PhpMyAdmin/phpmyadmin4.6.2_RCE.py · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5701 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9847 · Nota de Segurança
• https://suse.com/security/cve/CVE-2014-4986 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5731 · Nota de Segurança
• https://suse.com/security/cve/CVE-2013-4998 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6609 · Nota de Segurança
• https://suse.com/security/cve/CVE-2015-6830 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6624 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2016-6607 · Nota de Segurança
• https://suse.com/security/cve/CVE-2013-5002 · Nota
• https://suse.com/security/cve/CVE-2014-9218 · Nota
• https://suse.com/security/cve/CVE-2015-8669 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9855 · Nota de Segurança