PT-2017-9003 · Phpmyadmin+2 · Phpmyadmin+2

E3Amn2L · Published 2014-05-05 · Updated 2024-06-15 · CVE-2016-6621

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.0.10.19 phpMyAdmin versions 4.4.x prior to 4.4.15.10 phpMyAdmin versions 4.6.x prior to 4.6.6

Description The issue allows remote attackers to conduct server-side request forgery (SSRF) attacks. No information is provided about the estimated number of potentially affected devices or real-world incidents.

Recommendations For versions prior to 4.0.10.19, update to version 4.0.10.19 or later. For versions 4.4.x prior to 4.4.15.10, update to version 4.4.15.10 or later. For versions 4.6.x prior to 4.6.6, update to version 4.6.6 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

ALT-PU-2014-1591

ALT-PU-2016-1758

CVE-2016-6621

DLA-1415-1

DLA-834-1

GHSA-44VV-MM86-7CG6

MGASA-2017-0038

OPENSUSE-SU-2016_2168-1

OPENSUSE-SU-2024:10054-1

Affected Products

Alt Linux

Suse

Phpmyadmin

References · 261

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmyadmin_null_termination_exec.rb · Exploit
• 🔥 https://github.com/coffeehb/Some-PoC-oR-ExP/blob/master/PhpMyAdmin/phpmyadmin4.6.2_RCE.py · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5701 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9847 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5731 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8669 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6609 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6624 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3902 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6623 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6606 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6614 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-6621 · Security Note
• https://errata.altlinux.org/ALT-PU-2016-1758 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6610 · Security Note