PT-2016-6992

CVE-2016-6616

Published

2016-08-29

Updated

2024-06-15

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.6.x prior to 4.6.4 phpMyAdmin versions 4.4.x prior to 4.4.15.8

Description An issue was discovered in the "User group" and "Designer" features of phpMyAdmin, allowing a user to execute an SQL injection attack against the account of the control user.

Recommendations For versions 4.6.x prior to 4.6.4, update to version 4.6.4 or later. For versions 4.4.x prior to 4.4.15.8, update to version 4.4.15.8 or later.

Exploitability

Fix

Impacts

Researchers

E3Amn2L

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers

CVE-2016-6616

ALT-PU-2016-2421